diff --git a/http/token_handler.go b/http/token_handler.go
index 3b9a8e3..0222534 100644
--- a/http/token_handler.go
+++ b/http/token_handler.go
@@ -14,7 +14,7 @@
 * limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
-*/
+ */
 package http
 
 import (
@@ -46,7 +46,7 @@ func (s *WebconfigServer) CreateTokenHandler(w http.ResponseWriter, r *http.Requ
 	// Unmarshal
 	tokenRequest := TokenRequest{}
 	if err := json.Unmarshal(bodyBytes, &tokenRequest); err != nil {
-		Error(w, http.StatusInternalServerError, err)
+		Error(w, http.StatusBadRequest, err)
 		return
 	}
 
diff --git a/http/webconfig_server_test.go b/http/webconfig_server_test.go
index a60a68f..f296e85 100644
--- a/http/webconfig_server_test.go
+++ b/http/webconfig_server_test.go
@@ -179,7 +179,7 @@ func TestTokenEndpointRemainsUnauthenticatedWhenDisabled(t *testing.T) {
 	req, err := http.NewRequest("POST", "/api/v1/token", strings.NewReader("not-json"))
 	assert.NilError(t, err)
 	res := ExecuteRequest(req, router).Result()
-	assert.Equal(t, res.StatusCode, http.StatusInternalServerError)
+	assert.Equal(t, res.StatusCode, http.StatusBadRequest)
 }
 
 func TestTokenEndpointRequiresApiTokenWhenEnabled(t *testing.T) {
@@ -203,7 +203,7 @@ func TestTokenEndpointUsesTestingMiddlewareInTestRouter(t *testing.T) {
 	req, err := http.NewRequest("POST", "/api/v1/token", strings.NewReader("not-json"))
 	assert.NilError(t, err)
 	res := ExecuteRequest(req, router).Result()
-	assert.Equal(t, res.StatusCode, http.StatusInternalServerError)
+	assert.Equal(t, res.StatusCode, http.StatusBadRequest)
 }
 
 func TestConfigEndpointUsesTestingMiddlewareInTestRouter(t *testing.T) {