diff --git a/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/KeysResource.java b/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/KeysResource.java
index d192165cb4..ef89b6b9c6 100644
--- a/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/KeysResource.java
+++ b/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/KeysResource.java
@@ -15,6 +15,7 @@
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import com.nimbusds.jose.JWSAlgorithm;
 import com.nimbusds.jose.JWSAlgorithm.Family;
@@ -45,7 +46,7 @@ public KeysResource(OAuthASProperties config)
 
 	@Path("/")
 	@GET
-	@Produces(JWKSet.MIME_TYPE)	
+	@Produces({JWKSet.MIME_TYPE, MediaType.APPLICATION_JSON})
 	public String getKeys() 
 	{
 		if (!config.getTokenSigner().isPKIEnabled())
diff --git a/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapper.java b/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapper.java
index ee79f6161b..0325441bc5 100644
--- a/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapper.java
+++ b/oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapper.java
@@ -4,6 +4,7 @@
  */
 package pl.edu.icm.unity.oauth.as.token.exception;
 
+import jakarta.ws.rs.ClientErrorException;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
@@ -25,7 +26,10 @@ class EngineExceptionMapper implements ExceptionMapper<Exception>
 
 	public Response toResponse(Exception ex)
 	{
-		if (ex instanceof AuthorizationException || ex instanceof AuthenticationException)
+		if (ex instanceof ClientErrorException)
+		{
+			return ((ClientErrorException) ex).getResponse();
+		} else if (ex instanceof AuthorizationException || ex instanceof AuthenticationException)
 		{
 			log.warn("Access denied for rest client", ex);
 			return Response.status(Status.FORBIDDEN)
diff --git a/oauth/src/test/java/pl/edu/icm/unity/oauth/as/DiscoveryResourceTest.java b/oauth/src/test/java/pl/edu/icm/unity/oauth/as/DiscoveryResourceTest.java
index b01754bb6c..7d5e67d335 100644
--- a/oauth/src/test/java/pl/edu/icm/unity/oauth/as/DiscoveryResourceTest.java
+++ b/oauth/src/test/java/pl/edu/icm/unity/oauth/as/DiscoveryResourceTest.java
@@ -12,6 +12,8 @@
 
 import java.util.HashSet;
 
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 
 import org.junit.jupiter.api.Test;
@@ -51,6 +53,14 @@ public void testDiscovery() throws ParseException
 		assertEquals(7, parsed.getResponseTypes().size());
 	}
 	
+	@Test
+	public void shouldProduceJWKSetAndJSON() throws NoSuchMethodException
+	{
+		Produces produces = KeysResource.class.getMethod("getKeys").getAnnotation(Produces.class);
+
+		assertThat(produces.value()).contains(JWKSet.MIME_TYPE, MediaType.APPLICATION_JSON);
+	}
+
 	@Test
 	public void testJWK() throws java.text.ParseException
 	{
diff --git a/oauth/src/test/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapperTest.java b/oauth/src/test/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapperTest.java
new file mode 100644
index 0000000000..66330327cf
--- /dev/null
+++ b/oauth/src/test/java/pl/edu/icm/unity/oauth/as/token/exception/EngineExceptionMapperTest.java
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2014 ICM Uniwersytet Warszawski All rights reserved.
+ * See LICENCE.txt file for licensing information.
+ */
+package pl.edu.icm.unity.oauth.as.token.exception;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+
+import org.junit.jupiter.api.Test;
+
+public class EngineExceptionMapperTest
+{
+	@Test
+	public void shouldPreserveClientErrorResponse()
+	{
+		Response originalResponse = Response.status(Response.Status.NOT_ACCEPTABLE).build();
+
+		Response response = new EngineExceptionMapper().toResponse(new ClientErrorException(originalResponse));
+
+		assertThat(response.getStatus()).isEqualTo(Response.Status.NOT_ACCEPTABLE.getStatusCode());
+	}
+}