diff --git a/full/Changes b/full/Changes
index ff981f6..c72f6df 100644
--- a/full/Changes
+++ b/full/Changes
@@ -6,7 +6,9 @@
 05/02/2020
    - Added a config properties for a long-time access token expiry 
      and excluded refresh tokens for public clients in OAuth2 token 
-     responses (margaretha) 
+     responses (margaretha)
+   - Removed client authentication from the client deregistration and 
+     client-secret reset APIs (margaretha)   
    
 # version 0.62.3
 03/12/2019
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
index 05280a2..a4188c8 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
@@ -184,14 +184,11 @@
         return true;
     }
 
-    public void deregisterClient (String clientId, String clientSecret,
-            String username) throws KustvaktException {
+    public void deregisterClient (String clientId, String username)
+            throws KustvaktException {
 
         OAuth2Client client = clientDao.retrieveClientById(clientId);
-        if (client.getType().equals(OAuth2ClientType.CONFIDENTIAL)) {
-            authenticateClient(clientId, clientSecret);
-        }
-
+        
         if (adminDao.isAdmin(username)
                 || client.getRegisteredBy().equals(username)) {
 
@@ -231,10 +228,10 @@
         }
     }
 
-    public OAuth2ClientDto resetSecret (String clientId, String clientSecret,
-            String username) throws KustvaktException {
+    public OAuth2ClientDto resetSecret (String clientId, String username)
+            throws KustvaktException {
 
-        OAuth2Client client = authenticateClient(clientId, clientSecret);
+        OAuth2Client client = clientDao.retrieveClientById(clientId);
         if (!client.getType().equals(OAuth2ClientType.CONFIDENTIAL)) {
             throw new KustvaktException(StatusCodes.NOT_ALLOWED,
                     "Operation is not allowed for public clients",
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
index 6763241..04927c9 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
@@ -124,17 +124,14 @@
      */
     @DELETE
     @Path("deregister/{client_id}")
-    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response deregisterClient (
             @Context SecurityContext securityContext,
-            @PathParam("client_id") String clientId,
-            @FormParam("client_secret") String clientSecret) {
+            @PathParam("client_id") String clientId) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
             scopeService.verifyScope(context, OAuth2Scope.DEREGISTER_CLIENT);
-            clientService.deregisterClient(clientId, clientSecret,
-                    context.getUsername());
+            clientService.deregisterClient(clientId, context.getUsername());
             return Response.ok().build();
         }
         catch (KustvaktException e) {
@@ -158,14 +155,12 @@
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public OAuth2ClientDto resetClientSecret (
             @Context SecurityContext securityContext,
-            @FormParam("client_id") String clientId,
-            @FormParam("client_secret") String clientSecret) {
+            @FormParam("client_id") String clientId) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
             scopeService.verifyScope(context, OAuth2Scope.RESET_CLIENT_SECRET);
-            return clientService.resetSecret(clientId, clientSecret,
-                    context.getUsername());
+            return clientService.resetSecret(clientId, context.getUsername());
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
index 2ee4bc2..3183beb 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
@@ -136,13 +136,11 @@
         assertNotNull(clientSecret);
 
         testRegisterClientNonUniqueURL();
+        testResetConfidentialClientSecret(clientId, clientSecret);
 
-        String newclientSecret =
-                testResetConfidentialClientSecret(clientId, clientSecret);
-
-        testDeregisterConfidentialClientMissingSecret(clientId);
-        testDeregisterClientIncorrectCredentials(clientId, clientSecret);
-        testDeregisterConfidentialClient(clientId, newclientSecret);
+//        testDeregisterConfidentialClientMissingSecret(clientId);
+//        testDeregisterClientIncorrectCredentials(clientId, clientSecret);
+        testDeregisterConfidentialClient(clientId);
     }
 
     private void testRegisterClientNonUniqueURL () throws KustvaktException {
@@ -291,24 +289,20 @@
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
     }
 
-    private void testDeregisterConfidentialClient (String clientId,
-            String clientSecret) throws UniformInterfaceException,
-            ClientHandlerException, KustvaktException {
-
-        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
-        form.add("client_secret", clientSecret);
+    private void testDeregisterConfidentialClient (String clientId)
+            throws UniformInterfaceException, ClientHandlerException,
+            KustvaktException {
 
         ClientResponse response = resource().path(API_VERSION).path("oauth2")
                 .path("client").path("deregister").path(clientId)
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
                         .createBasicAuthorizationHeaderValue(username, "pass"))
-                .header(HttpHeaders.CONTENT_TYPE,
-                        ContentType.APPLICATION_FORM_URLENCODED)
-                .entity(form).delete(ClientResponse.class);
+                .delete(ClientResponse.class);
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
     }
 
+    @Deprecated
     private void testDeregisterConfidentialClientMissingSecret (String clientId)
             throws KustvaktException {
 
@@ -329,6 +323,7 @@
                 node.at("/error_description").asText());
     }
 
+    @Deprecated
     private void testDeregisterClientIncorrectCredentials (String clientId,
             String clientSecret) throws UniformInterfaceException,
             ClientHandlerException, KustvaktException {
@@ -424,7 +419,7 @@
         testAccessTokenAfterUpgradingClient(clientId, accessToken);
         testAccessTokenAfterDegradingSuperClient(clientId, accessToken);
 
-        testDeregisterConfidentialClient(clientId, clientSecret);
+        testDeregisterConfidentialClient(clientId);
     }
 
     // old access tokens retain their scopes