diff --git a/asset/asset.go b/asset/asset.go
index f11871e..c7e972e 100644
--- a/asset/asset.go
+++ b/asset/asset.go
@@ -304,7 +304,7 @@ func (a *Asset) query() string {
 			panic(err)
 		}
 
-		return a.AuthToken.Generate(u.Path)
+		return a.AuthToken.Generate(u.EscapedPath())
 	}
 
 	if !a.Config.URL.Analytics {
diff --git a/asset/auth_token_test.go b/asset/auth_token_test.go
index 7017b2b..34b1c9d 100644
--- a/asset/auth_token_test.go
+++ b/asset/auth_token_test.go
@@ -1,6 +1,7 @@
 package asset_test
 
 import (
+	"github.com/cloudinary/cloudinary-go/v2/api"
 	"github.com/cloudinary/cloudinary-go/v2/asset"
 	"github.com/cloudinary/cloudinary-go/v2/config"
 	"github.com/stretchr/testify/assert"
@@ -66,3 +67,17 @@ func TestAsset_AuthToken_EscapeToLower(t *testing.T) {
 
 	assert.Equal(t, expected, a.Generate("Encode these :~@#%^&{}[]\\\"';/\", but not those $!()_.*"))
 }
+
+// The token signs the escaped URL path, like the other Cloudinary SDKs.
+func TestAsset_AuthToken_SignsEscapedPath(t *testing.T) {
+	conf, _ := config.NewFromParams("test123", "key", "secret")
+
+	i, _ := asset.Image("ñandú.jpg", conf)
+	i.DeliveryType = api.Authenticated
+	i.Version = 1486020273
+	i.Config.URL.SignURL = true
+	i.AuthToken.Config = &config.AuthToken{Key: authTokenKey, Duration: duration, StartTime: startTime}
+
+	assert.Contains(t, getAssetUrl(t, i), "image/authenticated/v1486020273/%C3%B1and%C3%BA.jpg?__cld_token__=st=11111111~exp=11111411"+
+		"~hmac=e0dba2c6680a1efe6a89c4dc0302c86400d2684dcc07da32db4e9804ee284955")
+}