diff --git a/changelog.d/2110.bugfix.md b/changelog.d/2110.bugfix.md
index 030d55ab0..6ea4c6c6d 100644
--- a/changelog.d/2110.bugfix.md
+++ b/changelog.d/2110.bugfix.md
@@ -1 +1 @@
-The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. Contributed by @mmaudet.
+The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. The token endpoint now returns the `unauthorized_client` error code when a client requests a grant type it did not register, instead of `invalid_grant`. Contributed by @mmaudet.
diff --git a/src/service/oauth/mod.rs b/src/service/oauth/mod.rs
index 114b1edec..e0aa3a9d0 100644
--- a/src/service/oauth/mod.rs
+++ b/src/service/oauth/mod.rs
@@ -442,7 +442,7 @@ pub async fn issue_token(&self, request: TokenRequest) -> Result<TokenResponse,
 		};
 
 		if !client_metadata.grant_types.contains(&request.grant_type()) {
-			return Err(OAuthError::invalid_grant("Client cannot request this grant type"));
+			return Err(OAuthError::unauthorized_client("Client cannot request this grant type"));
 		}
 
 		match request {