diff --git a/xroot_plugins/XrdSsiCtaRequestMessage.cpp b/xroot_plugins/XrdSsiCtaRequestMessage.cpp
index d85d9a8f8aa3247a501d22a3fd058a00a1abaf51..d4a3af3eb0d2484e7da6acccf2f0e8308e0dec6e 100644
--- a/xroot_plugins/XrdSsiCtaRequestMessage.cpp
+++ b/xroot_plugins/XrdSsiCtaRequestMessage.cpp
@@ -291,6 +291,12 @@ void RequestMessage::process(const cta::xrd::Request &request, cta::xrd::Respons
          break;
 
       case Request::kNotification:
+         // Validate that instance name in SSS key and instance name in Protocol buffer match
+         if(m_cliIdentity.username != request.notification().wf().instance().name()) {
+            throw PbException("Instance name \"" + request.notification().wf().instance().name() +
+                              "\" does not match key identifier \"" + m_cliIdentity.username + "\"");
+         }
+
          // Map the Workflow Event to a method
          switch(request.notification().wf().event()) {
             using namespace cta::eos;
diff --git a/xroot_plugins/XrdSsiCtaRequestMessage.hpp b/xroot_plugins/XrdSsiCtaRequestMessage.hpp
index a5f11088458057fd6cbb5b7d334572be42b8391d..1df8281dd8257930b681c4889bfa86d17cc0f6ff 100644
--- a/xroot_plugins/XrdSsiCtaRequestMessage.hpp
+++ b/xroot_plugins/XrdSsiCtaRequestMessage.hpp
@@ -40,7 +40,7 @@ public:
          m_cliIdentity.username = client.name;
          m_cliIdentity.host     = client.host;
 
-         // Map the client protcol string to an enum value
+         // Map the client protocol string to an enum value
          auto proto_it = m_protomap.find(client.prot);
          m_protocol = proto_it != m_protomap.end() ? proto_it->second : Protocol::OTHER;
       }