diff --git a/lib/error.js b/lib/error.js
index 4c4901760..834e423b9 100644
--- a/lib/error.js
+++ b/lib/error.js
@@ -90,7 +90,7 @@ AppError.unknownClient = function unknownClient(clientId) {
 
 AppError.incorrectSecret = function incorrectSecret(clientId) {
   return new AppError({
-    code: 400,
+    code: 401,
     error: 'Bad Request',
     errno: 102,
     message: 'Incorrect secret'
diff --git a/test/api.js b/test/api.js
index 3727357ba..f045b53fa 100644
--- a/test/api.js
+++ b/test/api.js
@@ -631,7 +631,7 @@ describe('/v1', function() {
             code: unique.code().toString('hex')
           }
         }).then(function(res) {
-          assert.equal(res.statusCode, 400);
+          assert.equal(res.statusCode, 401);
           assert.equal(res.result.message, 'Incorrect secret');
         }).done(done, done);
       });