diff --git a/src/api/core/key_connector.rs b/src/api/core/key_connector.rs
index f7c60371..a7fe27d1 100644
--- a/src/api/core/key_connector.rs
+++ b/src/api/core/key_connector.rs
@@ -44,6 +44,10 @@ async fn post_set_key_connector_key(data: Json<SetKeyConnectorKeyData>, headers:
     let data = data.into_inner();
     let mut user = headers.user;
 
+    if user.private_key.is_some() {
+        err!("Account already initialized, cannot set Key Connector key");
+    }
+
     user.client_kdf_type = data.kdf;
     user.client_kdf_iter = data.kdf_iterations;
     user.client_kdf_memory = data.kdf_memory;
@@ -69,6 +73,11 @@ async fn post_convert_to_key_connector(headers: Headers, conn: DbConn) -> EmptyR
     }
 
     let mut user = headers.user;
+
+    if user.private_key.is_none() {
+        err!("Account is not initialized, cannot convert to Key Connector");
+    }
+
     user.password_hash = Vec::new();
     user.password_hint = None;
     user.uses_key_connector = true;
diff --git a/src/api/identity.rs b/src/api/identity.rs
index c08a2b2a..dc3ea6b9 100644
--- a/src/api/identity.rs
+++ b/src/api/identity.rs
@@ -515,7 +515,10 @@ async fn authenticated_response(
     let master_password_policy = master_password_policy(user, conn).await;
 
     // Key connector users have no master password, the master key is stored on the connector
-    let uses_key_connector = CONFIG.key_connector_enabled() && user.uses_key_connector;
+    let uses_key_connector = user.uses_key_connector;
+    if uses_key_connector && !CONFIG.key_connector_enabled() {
+        err!("This user's master key is stored on a key connector, but Key Connector support is disabled")
+    }
     let has_master_password = !user.password_hash.is_empty() && !uses_key_connector;
     let master_password_unlock = if has_master_password {
         json!({
diff --git a/src/config.rs b/src/config.rs
index 8855210c..8c57e0bd 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1104,6 +1104,9 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         if cfg.key_connector_url.is_empty() {
             err!("`KEY_CONNECTOR_URL` must be set when Key Connector is enabled")
         }
+        if Url::parse(&cfg.key_connector_url).is_err() {
+            err!("Invalid URL format for `KEY_CONNECTOR_URL`.");
+        }
     }
 
     if cfg._enable_yubico {