diff --git a/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.ts b/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.ts
index 772914bb53211..3d6084d37a384 100644
--- a/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.ts
+++ b/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.ts
@@ -38,13 +38,12 @@ export function initSpacesOnPostAuthRequestInterceptor({
     const isRequestingSpaceRoot = path === '/' && spaceId !== DEFAULT_SPACE_ID;
     const isRequestingApplication = path.startsWith('/app');
 
-    const spacesClient = await spacesService.scopedClient(request);
-
     // if requesting the application root, then show the Space Selector UI to allow the user to choose which space
     // they wish to visit. This is done "onPostAuth" to allow the Saved Objects Client to use the request's auth credentials,
     // which is not available at the time of "onRequest".
     if (isRequestingKibanaRoot) {
       try {
+        const spacesClient = await spacesService.scopedClient(request);
         const spaces = await spacesClient.getAll();
 
         if (spaces.length === 1) {
@@ -77,6 +76,7 @@ export function initSpacesOnPostAuthRequestInterceptor({
       try {
         log.debug(`Verifying access to space "${spaceId}"`);
 
+        const spacesClient = await spacesService.scopedClient(request);
         space = await spacesClient.get(spaceId);
       } catch (error) {
         const wrappedError = wrapError(error);