diff --git a/src/opengnsys/service.py b/src/opengnsys/service.py
index f9b4292..4ed2d3e 100644
--- a/src/opengnsys/service.py
+++ b/src/opengnsys/service.py
@@ -146,11 +146,8 @@ class CommonService(object):
         self.ipc = ipc.ServerIPC(self.ipcport, clientMessageProcessor=self.clientMessageProcessor)
         self.ipc.start()
 
-        # And http threaded server
-        self.httpServer = httpserver.HTTPServerThread(self.address, self)
-        self.httpServer.start()
-        
-        # And lastly invoke modules activation
+        # Activate modules before exposing the HTTP server so that no request
+        # arrives before the secret has been sent to ogcore via ogagent/started.
         validMods = []
         for mod in self.modules:
             try:
@@ -160,11 +157,15 @@ class CommonService(object):
             except Exception as e:
                 logger.exception()
                 logger.debug("Activation of {} failed: {}".format(mod.name, exceptionToMessage(e)))
-        
+
         self.modules[:] = validMods  # copy instead of assignment
-        
+
         logger.debug('Modules after activation: {}'.format(list(v.name for v in self.modules)))
 
+        # Start HTTP server only after all modules are active and ogcore knows the secret.
+        self.httpServer = httpserver.HTTPServerThread(self.address, self)
+        self.httpServer.start()
+
     def terminate(self):
         # First invoke deactivate on modules
         for mod in reversed(self.modules):