diff --git a/full/src/main/java/de/ids_mannheim/korap/service/OAuth2ClientService.java b/full/src/main/java/de/ids_mannheim/korap/service/OAuth2ClientService.java
index 75d09fb..c6c732b 100644
--- a/full/src/main/java/de/ids_mannheim/korap/service/OAuth2ClientService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/service/OAuth2ClientService.java
@@ -50,6 +50,16 @@
 
         String secret = null;
         if (clientJson.getType().equals(OAuth2ClientType.CONFIDENTIAL)) {
+            // RFC 6749:
+            // The authorization server MUST NOT issue client passwords or other
+            // client credentials to native application (clients installed and 
+            // executed on the device used by the resource owner e.g. desktop  
+            // application, native mobile application) or user-agent-based
+            // application clients for client authentication.  The authorization
+            // server MAY issue a client password or other credentials
+            // for a specific installation of a native application client on a
+            // specific device.
+
             secret = encryption.createToken();
         }
 
@@ -78,7 +88,7 @@
     }
 
 
-    public void deregisterClient (String clientId, String username)
+    public void deregisterPublicClient (String clientId, String username)
             throws KustvaktException {
 
         OAuth2Client client = clientDao.retrieveClientById(clientId);
@@ -88,7 +98,9 @@
         else if (client.getType().equals(OAuth2ClientType.CONFIDENTIAL)) {
             throw new KustvaktException(
                     StatusCodes.CLIENT_DEREGISTRATION_FAILED,
-                    "Service is limited to public clients.");
+                    "Service is limited to public clients. To deregister "
+                            + "confidential clients, use service at path: "
+                            + "oauth2/client/deregister/confidential.");
         }
         else if (client.getRegisteredBy().equals(username)) {
             clientDao.deregisterClient(client);
@@ -100,6 +112,12 @@
     }
 
 
+    public void deregisterConfidentialClient (String authorization,
+            String clientId) throws KustvaktException {
+        OAuth2Client client = authenticateClient(authorization, null, clientId);
+        clientDao.deregisterClient(client);
+    }
+
     public TokenContext requestAccessTokenByClientCredentials (
             String authorization, String grantType) throws KustvaktException {
 
@@ -120,19 +138,19 @@
      * 
      * @param authorization
      * @param grantType
-     * @param client_id
+     * @param clientId
      * @return
      * @throws KustvaktException
      */
     public OAuth2Client authenticateClient (String authorization,
-            GrantType grantType, String client_id) throws KustvaktException {
+            GrantType grantType, String clientId) throws KustvaktException {
 
-        OAuth2Client client = clientDao.retrieveClientById(client_id);
+        OAuth2Client client = clientDao.retrieveClientById(clientId);
 
         if (authorization == null || authorization.isEmpty()) {
             if (client.getType().equals(OAuth2ClientType.CONFIDENTIAL)
                     || grantType.equals(GrantType.CLIENT_CREDENTIALS)) {
-                new KustvaktException(StatusCodes.CLIENT_AUTHENTICATION_FAILED,
+                throw new KustvaktException(StatusCodes.AUTHENTICATION_FAILED,
                         "Authorization header is not found.");
             }
             // OAuth2 does not require client authentication
@@ -142,9 +160,11 @@
                     .parseAuthorizationHeaderValue(authorization);
             if (authData.getAuthenticationScheme()
                     .equals(AuthenticationScheme.BASIC)) {
-                if (!client.getSecret().equals(authData.getPassword())) {
-                    new KustvaktException(
-                            StatusCodes.CLIENT_AUTHENTICATION_FAILED,
+                authorizationHandler.parseBasicToken(authData);
+                if (!client.getId().equals(clientId)
+                        || !client.getSecret().equals(authData.getPassword())) {
+                    throw new KustvaktException(
+                            StatusCodes.AUTHENTICATION_FAILED,
                             "Client credentials are incorrect.");
                 }
             }
@@ -158,4 +178,5 @@
         }
         return client;
     }
+
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
index a770e0f..eba6325 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthClientController.java
@@ -3,6 +3,7 @@
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
 import javax.ws.rs.FormParam;
+import javax.ws.rs.HeaderParam;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
@@ -78,13 +79,13 @@
     @Path("deregister")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
-    public Response deregisterClient (
+    public Response deregisterPublicClient (
             @Context SecurityContext securityContext,
             @FormParam("client_id") String clientId) {
         TokenContext context =
                 (TokenContext) securityContext.getUserPrincipal();
         try {
-            clientService.deregisterClient(clientId,
+            clientService.deregisterPublicClient(clientId,
                     context.getUsername());
             return Response.ok().build();
         }
@@ -92,19 +93,21 @@
             throw responseHandler.throwit(e);
         }
     }
-    
 
-//    @POST
-//    @Path("deregister")
-//    public OAuth2ClientDto deregisterClient (
-//            @Context SecurityContext securityContext) {
-//        TokenContext context =
-//                (TokenContext) securityContext.getUserPrincipal();
-//        try {
-//            return clientService.deregisterClient();
-//        }
-//        catch (KustvaktException e) {
-//            throw responseHandler.throwit(e);
-//        }
-//    }
+
+    @DELETE
+    @Path("deregister/confidential")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response deregisterConfidentialClient (
+            @Context SecurityContext securityContext,
+            @HeaderParam("Authorization") String authorization,
+            @FormParam("client_id") String clientId) {
+        try {
+            clientService.deregisterConfidentialClient(authorization, clientId);
+            return Response.ok().build();
+        }
+        catch (KustvaktException e) {
+            throw responseHandler.throwit(e);
+        }
+    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
index 47e5968..3a91014 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuthController.java
@@ -43,17 +43,14 @@
 
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.config.AuthCodeInfo;
-import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.ClientInfo;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.Scopes;
 import de.ids_mannheim.korap.constant.AuthenticationMethod;
 import de.ids_mannheim.korap.constant.TokenType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
-import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.handlers.OAuth2Handler;
 import de.ids_mannheim.korap.interfaces.AuthenticationManagerIface;
-import de.ids_mannheim.korap.interfaces.EncryptionIface;
 import de.ids_mannheim.korap.security.context.TokenContext;
 import de.ids_mannheim.korap.user.User;
 import de.ids_mannheim.korap.user.UserDetails;
@@ -97,25 +94,25 @@
     }
 
 
-    @POST
-    @Path("unregister")
-    @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
-    public Response unregisterClient (@Context SecurityContext context,
-            @HeaderParam("Host") String host,
-            @QueryParam("client_secret") String secret,
-            @QueryParam("client_id") String client_id) {
-        ClientInfo info = new ClientInfo(client_id, secret);
-        info.setUrl(host);
-        TokenContext ctx = (TokenContext) context.getUserPrincipal();
-        try {
-            this.handler.getPersistenceHandler().removeClient(info,
-                    this.controller.getUser(ctx.getUsername()));
-        }
-        catch (KustvaktException e) {
-            throw kustvaktResponseHandler.throwit(e);
-        }
-        return Response.ok().build();
-    }
+//    @POST
+//    @Path("unregister")
+//    @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
+//    public Response unregisterClient (@Context SecurityContext context,
+//            @HeaderParam("Host") String host,
+//            @QueryParam("client_secret") String secret,
+//            @QueryParam("client_id") String client_id) {
+//        ClientInfo info = new ClientInfo(client_id, secret);
+//        info.setUrl(host);
+//        TokenContext ctx = (TokenContext) context.getUserPrincipal();
+//        try {
+//            this.handler.getPersistenceHandler().removeClient(info,
+//                    this.controller.getUser(ctx.getUsername()));
+//        }
+//        catch (KustvaktException e) {
+//            throw kustvaktResponseHandler.throwit(e);
+//        }
+//        return Response.ok().build();
+//    }
 
 
 //    @POST
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
index dc052ec..e54f354 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
@@ -57,14 +57,19 @@
         String entity = response.getEntity(String.class);
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
         JsonNode node = JsonUtils.readTree(entity);
-        assertNotNull(node.at("/client_id").asText());
-        assertNotNull(node.at("/client_secret").asText());
+        String clientId = node.at("/client_id").asText();
+        String clientSecret = node.at("/client_secret").asText();
+        assertNotNull(clientId);
+        assertNotNull(clientSecret);
 
         response = testRegisterConfidentialClient();
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
         node = JsonUtils.readTree(response.getEntity(String.class));
         assertEquals(StatusCodes.CLIENT_REGISTRATION_FAILED,
                 node.at("/errors/0/0").asInt());
+
+        testDeregisterClientIncorrectCredentials(clientId);
+        testDeregisterConfidentialClient(clientId, clientSecret);
     }
 
     @Test
@@ -114,4 +119,49 @@
 
         assertEquals(Status.OK.getStatusCode(), response.getStatus());
     }
+
+    private void testDeregisterConfidentialClient (String clientId,
+            String clientSecret) throws UniformInterfaceException,
+            ClientHandlerException, KustvaktException {
+        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+        form.add("client_id", clientId);
+
+        ClientResponse response = resource().path("oauth2").path("client")
+                .path("deregister").path("confidential")
+                .header(Attributes.AUTHORIZATION,
+                        handler.createBasicAuthorizationHeaderValue(clientId,
+                                clientSecret))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .header(HttpHeaders.CONTENT_TYPE,
+                        ContentType.APPLICATION_FORM_URLENCODED)
+                .entity(form).delete(ClientResponse.class);
+
+        assertEquals(Status.OK.getStatusCode(), response.getStatus());
+    }
+
+    private void testDeregisterClientIncorrectCredentials (String clientId)
+            throws UniformInterfaceException, ClientHandlerException,
+            KustvaktException {
+        MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+        form.add("client_id", clientId);
+
+        ClientResponse response = resource().path("oauth2").path("client")
+                .path("deregister").path("confidential")
+                .header(Attributes.AUTHORIZATION,
+                        handler.createBasicAuthorizationHeaderValue(clientId,
+                                "pass"))
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+                .header(HttpHeaders.CONTENT_TYPE,
+                        ContentType.APPLICATION_FORM_URLENCODED)
+                .entity(form).delete(ClientResponse.class);
+
+        assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
+
+        String entity = response.getEntity(String.class);
+        JsonNode node = JsonUtils.readTree(entity);
+        assertEquals(StatusCodes.AUTHENTICATION_FAILED,
+                node.at("/errors/0/0").asInt());
+        assertEquals("Client credentials are incorrect.",
+                node.at("/errors/0/1").asText());
+    }
 }