A failed client authentication should return invalid_client. unauthorized_client means that the client is authenticated but not authorized to perform the request. See http://tools.ietf.org/html/rfc6749#section-5.2