diff --git a/Changes b/Changes
index 845b4ec..0049d3c 100644
--- a/Changes
+++ b/Changes
@@ -11,6 +11,7 @@
   for testing 
 - Setup creating marlin-vc and published-vc in VirtualCorpusTestBase 
   instead of using SQL for testing 
+- Fixed request URI at OAuth2 token request API.  
 
 # version 0.76
 
diff --git a/pom.xml b/pom.xml
index 1eca2a8..0b16432 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@
 		<jetty.version>11.0.24</jetty.version>
 		<flyway.version>10.6.0</flyway.version>
 		<log4j.version>2.22.1</log4j.version>
-		<krill.version>0.63.3</krill.version>
+		<krill.version>[0.63.3,)</krill.version>
 		<koral.version>[0.44,)</koral.version>
 	</properties>
 	<profiles>
diff --git a/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java b/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
index 8ab3e2a..60dd425 100644
--- a/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
+++ b/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
@@ -266,9 +266,6 @@
             URI requestURI;
             UriBuilder builder = UriBuilder
                     .fromPath(request.getRequestURL().toString());
-            for (String key : form.keySet()) {
-                builder.queryParam(key, form.get(key).toArray());
-            }
             requestURI = builder.build();
 
             try {
diff --git a/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java b/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
index 0495355..8e8d626 100644
--- a/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
@@ -249,4 +249,22 @@
         
         revokeTokenViaSuperClient(userAuthToken, userAuthHeader);
     }
+    
+	@Test
+	public void testRequestAuthorizationWithPassword ()
+			throws KustvaktException {
+		Response response = requestTokenWithPassword(superClientId,
+				clientSecret, "username", "pass}");
+		String entity = response.readEntity(String.class);
+		JsonNode node = JsonUtils.readTree(entity);
+		String accessToken = node.at("/access_token").asText();
+		assertNotNull(accessToken);
+		String refreshToken = node.at("/refresh_token").asText();
+		assertNotNull(refreshToken);
+		assertEquals(OAuth2Scope.ALL.name().toLowerCase(),
+				node.at("/scope").asText());
+		assertEquals(TokenType.BEARER.displayName(),
+				node.at("/token_type").asText());
+		assertNotNull(node.at("/expires_in").asText());
+	}
 }