diff --git a/src/lib/server/oauth2/controller/authorization.ts b/src/lib/server/oauth2/controller/authorization.ts
index 7820359..d2aaebe 100644
--- a/src/lib/server/oauth2/controller/authorization.ts
+++ b/src/lib/server/oauth2/controller/authorization.ts
@@ -80,7 +80,7 @@ export class OAuth2AuthorizationController {
 		// console.debug('Parameter grant_type is', grantTypes.join(' '));
 
 		const client = await OAuth2Clients.fetchById(clientId);
-		if (!client) {
+		if (!client || client.activated === 0) {
 			throw new InvalidClient('Client not found');
 		}
 
diff --git a/src/lib/server/oauth2/controller/bearer.ts b/src/lib/server/oauth2/controller/bearer.ts
index 4a243ae..4244b63 100644
--- a/src/lib/server/oauth2/controller/bearer.ts
+++ b/src/lib/server/oauth2/controller/bearer.ts
@@ -1,3 +1,4 @@
+import { ApiUtils } from '$lib/server/api-utils';
 import { AccessDenied } from '../error';
 import { OAuth2AccessTokens, type OAuth2AccessToken } from '../model';
 
@@ -28,7 +29,7 @@ export class OAuth2BearerController {
 		} else if (url?.searchParams.has('access_token')) {
 			token = url.searchParams.get('access_token') as string;
 		} else {
-			const body = await request.json().catch(() => ({}));
+			const body = await ApiUtils.getJsonOrFormBody(request);
 			if (!body.access_token) {
 				throw new AccessDenied('Bearer token not found');
 			}
diff --git a/src/lib/server/oauth2/controller/introspection.ts b/src/lib/server/oauth2/controller/introspection.ts
index 0145aba..1a24369 100644
--- a/src/lib/server/oauth2/controller/introspection.ts
+++ b/src/lib/server/oauth2/controller/introspection.ts
@@ -44,7 +44,7 @@ export class OAuth2IntrospectionController {
 
 		const client = await OAuth2Clients.fetchById(clientId);
 
-		if (!client) {
+		if (!client || client.activated === 0) {
 			throw new InvalidClient('Client not found');
 		}
 
diff --git a/src/lib/server/oauth2/controller/token.ts b/src/lib/server/oauth2/controller/token.ts
index 92c369a..3dcc43c 100644
--- a/src/lib/server/oauth2/controller/token.ts
+++ b/src/lib/server/oauth2/controller/token.ts
@@ -56,7 +56,7 @@ export class OAuth2TokenController {
 
 		const client = await OAuth2Clients.fetchById(clientId);
 
-		if (!client) {
+		if (!client || client.activated === 0) {
 			throw new InvalidClient('Client not found');
 		}
 
diff --git a/src/lib/server/oauth2/model/tokens.ts b/src/lib/server/oauth2/model/tokens.ts
index 392f94c..c835bac 100644
--- a/src/lib/server/oauth2/model/tokens.ts
+++ b/src/lib/server/oauth2/model/tokens.ts
@@ -165,6 +165,10 @@ export class OAuth2Codes {
 		}
 
 		const client = await OAuth2Clients.fetchById(find.clientId as number);
+		if (!client || client.activated === 0) {
+			return undefined;
+		}
+
 		return {
 			...find,
 			clientIdPub: client.client_id,
@@ -227,6 +231,10 @@ export class OAuth2AccessTokens {
 		}
 
 		const client = await OAuth2Clients.fetchById(find.clientId as number);
+		if (!client || client.activated === 0) {
+			return undefined;
+		}
+
 		return {
 			...find,
 			clientIdPub: client.client_id
@@ -291,6 +299,10 @@ export class OAuth2RefreshTokens {
 		}
 
 		const client = await OAuth2Clients.fetchById(find.clientId as number);
+		if (!client || client.activated === 0) {
+			return undefined;
+		}
+
 		return {
 			...find,
 			clientIdPub: client.client_id