diff --git a/dspace_rest_client/client.py b/dspace_rest_client/client.py
index 8e238f2..0115557 100644
--- a/dspace_rest_client/client.py
+++ b/dspace_rest_client/client.py
@@ -218,7 +218,7 @@ def api_get(self, url, params=None, data=None, headers=None):
         self.update_token(r)
         return r
 
-    def api_post(self, url, params, json, retry=False):
+    def api_post(self, url, params, json, retry=False, timeout=None):
         """
         Perform a POST request. Refresh XSRF token if necessary.
         POSTs are typically used to create objects.
@@ -230,7 +230,7 @@ def api_post(self, url, params, json, retry=False):
         """
         self._last_err = None
         r = self.session.post(url, json=json, params=params, headers=self.request_headers,
-                              proxies=self.proxies)
+                              proxies=self.proxies, timeout=timeout)
         self.update_token(r)
 
         if r.status_code == 403:
@@ -239,18 +239,18 @@ def api_post(self, url, params, json, retry=False):
             # After speaking in #dev it seems that these do need occasional refreshes but I suspect
             # it's happening too often for me, so check for accidentally triggering it
             r_json = parse_json(r)
-            if 'message' in r_json and 'CSRF token' in r_json['message']:
+            if 'message' in (r_json or {}) and 'CSRF token' in r_json['message']:
                 if retry:
                     _logger.warning(f'Too many retries updating token: {r.status_code}: {r.text}')
                 else:
                     _logger.debug("Retrying request with updated CSRF token")
-                    return self.api_post(url, params=params, json=json, retry=True)
+                    return self.api_post(url, params=params, json=json, retry=True, timeout=timeout)
 
         # we need to log in again, if there is login error. This is a bad
         # solution copied from the past
         elif r.status_code == 401:
             r_json = parse_json(r)
-            if 'message' in r_json and 'Authentication is required' in r_json['message']:
+            if 'message' in (r_json or {}) and 'Authentication is required' in r_json['message']:
                 if retry:
                     logging.error(
                         'API Post: Already retried... something must be wrong')
@@ -260,7 +260,7 @@ def api_post(self, url, params, json, retry=False):
                     self.authenticate()
                     # Try to authenticate and repeat the request 3 times -
                     # if it won't happen log error
-                    return self.api_post(url, params=params, json=json, retry=False)
+                    return self.api_post(url, params=params, json=json, retry=True, timeout=timeout)
         return r
 
     def api_post_uri(self, url, params, uri_list, retry=False):