diff --git a/buffet/device_registration_info.cc b/buffet/device_registration_info.cc
index e482d81..0b98cb7 100644
--- a/buffet/device_registration_info.cc
+++ b/buffet/device_registration_info.cc
@@ -66,27 +66,6 @@
   return {chromeos::http::request_header::kAuthorization, authorization};
 }
 
-std::unique_ptr<base::DictionaryValue> ParseOAuthResponse(
-    const chromeos::http::Response* response, chromeos::ErrorPtr* error) {
-  int code = 0;
-  auto resp = chromeos::http::ParseJsonResponse(response, &code, error);
-  if (resp && code >= chromeos::http::status_code::BadRequest) {
-    if (error) {
-      std::string error_code, error_message;
-      if (resp->GetString("error", &error_code) &&
-          resp->GetString("error_description", &error_message)) {
-        chromeos::Error::AddTo(error, FROM_HERE, buffet::kErrorDomainOAuth2,
-                               error_code, error_message);
-      } else {
-        chromeos::Error::AddTo(error, FROM_HERE, buffet::kErrorDomainOAuth2,
-                               "unexpected_response", "Unexpected OAuth error");
-      }
-    }
-    return std::unique_ptr<base::DictionaryValue>();
-  }
-  return resp;
-}
-
 inline void SetUnexpectedError(chromeos::ErrorPtr* error) {
   chromeos::Error::AddTo(error, FROM_HERE, buffet::kErrorDomainGCD,
                          "unexpected_response", "Unexpected GCD error");
@@ -94,9 +73,6 @@
 
 void ParseGCDError(const base::DictionaryValue* json,
                    chromeos::ErrorPtr* error) {
-  if (!error)
-    return;
-
   const base::Value* list_value = nullptr;
   const base::ListValue* error_list = nullptr;
   if (!json->Get("error.errors", &list_value) ||
@@ -310,6 +286,31 @@
   return have_credentials;
 }
 
+std::unique_ptr<base::DictionaryValue>
+DeviceRegistrationInfo::ParseOAuthResponse(
+    const chromeos::http::Response* response, chromeos::ErrorPtr* error) {
+  int code = 0;
+  auto resp = chromeos::http::ParseJsonResponse(response, &code, error);
+  if (resp && code >= chromeos::http::status_code::BadRequest) {
+    std::string error_code, error_message;
+    if (!resp->GetString("error", &error_code)) {
+      error_code = "unexpected_response";
+    }
+    if (error_code == "invalid_grant") {
+      LOG(INFO) << "The device's registration has been revoked.";
+      SetRegistrationStatus(RegistrationStatus::kInvalidCredentials);
+    }
+    // I have never actually seen an error_description returned.
+    if (!resp->GetString("error_description", &error_message)) {
+      error_message = "Unexpected OAuth error";
+    }
+    chromeos::Error::AddTo(error, FROM_HERE, buffet::kErrorDomainOAuth2,
+                           error_code, error_message);
+    return std::unique_ptr<base::DictionaryValue>();
+  }
+  return resp;
+}
+
 bool DeviceRegistrationInfo::ValidateAndRefreshAccessToken(
     chromeos::ErrorPtr* error) {
   LOG(INFO) << "Checking access token expiration.";
diff --git a/buffet/device_registration_info.h b/buffet/device_registration_info.h
index 95c8b0d..7b2e3da 100644
--- a/buffet/device_registration_info.h
+++ b/buffet/device_registration_info.h
@@ -150,6 +150,11 @@
   // Makes sure the access token is available and up-to-date.
   bool ValidateAndRefreshAccessToken(chromeos::ErrorPtr* error);
 
+  // Parse the OAuth response, and sets registration status to
+  // kInvalidCredentials if our registration is no longer valid.
+  std::unique_ptr<base::DictionaryValue> ParseOAuthResponse(
+      const chromeos::http::Response* response, chromeos::ErrorPtr* error);
+
   // This attempts to open the XMPP channel. The XMPP channel needs to be
   // restarted anytime the access_token is refreshed.
   void StartXmpp();
diff --git a/buffet/device_registration_info_unittest.cc b/buffet/device_registration_info_unittest.cc
index dee5614..2912fb6 100644
--- a/buffet/device_registration_info_unittest.cc
+++ b/buffet/device_registration_info_unittest.cc
@@ -124,6 +124,28 @@
   response->ReplyJson(chromeos::http::status_code::Ok, &json);
 }
 
+void OAuth2HandlerFail(const ServerRequest& request,
+                       ServerResponse* response) {
+  base::DictionaryValue json;
+  EXPECT_EQ("refresh_token", request.GetFormField("grant_type"));
+  EXPECT_EQ(test_data::kRefreshToken, request.GetFormField("refresh_token"));
+  EXPECT_EQ(test_data::kClientId, request.GetFormField("client_id"));
+  EXPECT_EQ(test_data::kClientSecret, request.GetFormField("client_secret"));
+  json.SetString("error", "unable_to_authenticate");
+  response->ReplyJson(chromeos::http::status_code::BadRequest, &json);
+}
+
+void OAuth2HandlerDeregister(const ServerRequest& request,
+                             ServerResponse* response) {
+  base::DictionaryValue json;
+  EXPECT_EQ("refresh_token", request.GetFormField("grant_type"));
+  EXPECT_EQ(test_data::kRefreshToken, request.GetFormField("refresh_token"));
+  EXPECT_EQ(test_data::kClientId, request.GetFormField("client_id"));
+  EXPECT_EQ(test_data::kClientSecret, request.GetFormField("client_secret"));
+  json.SetString("error", "invalid_grant");
+  response->ReplyJson(chromeos::http::status_code::BadRequest, &json);
+}
+
 void DeviceInfoHandler(const ServerRequest& request, ServerResponse* response) {
   std::string auth = "Bearer ";
   auth += test_data::kAccessToken;
@@ -293,6 +315,46 @@
   EXPECT_EQ(1, transport_->GetRequestCount());
 }
 
+TEST_F(DeviceRegistrationInfoTest, CheckAuthenticationFailure) {
+  SetDefaultDeviceRegistration(&data_);
+  storage_->Save(&data_);
+  EXPECT_TRUE(dev_reg_->Load());
+  EXPECT_EQ(RegistrationStatus::kOffline,
+            dev_reg_->GetRegistrationStatus());
+
+  transport_->AddHandler(dev_reg_->GetOAuthURL("token"),
+                         chromeos::http::request_type::kPost,
+                         base::Bind(OAuth2HandlerFail));
+  transport_->ResetRequestCount();
+  chromeos::ErrorPtr error;
+  EXPECT_FALSE(dev_reg_->CheckRegistration(&error));
+  EXPECT_EQ(1, transport_->GetRequestCount());
+  EXPECT_TRUE(error->HasError(buffet::kErrorDomainOAuth2,
+                              "unable_to_authenticate"));
+  EXPECT_EQ(RegistrationStatus::kOffline,
+            dev_reg_->GetRegistrationStatus());
+}
+
+TEST_F(DeviceRegistrationInfoTest, CheckDeregistration) {
+  SetDefaultDeviceRegistration(&data_);
+  storage_->Save(&data_);
+  EXPECT_TRUE(dev_reg_->Load());
+  EXPECT_EQ(RegistrationStatus::kOffline,
+            dev_reg_->GetRegistrationStatus());
+
+  transport_->AddHandler(dev_reg_->GetOAuthURL("token"),
+                         chromeos::http::request_type::kPost,
+                         base::Bind(OAuth2HandlerDeregister));
+  transport_->ResetRequestCount();
+  chromeos::ErrorPtr error;
+  EXPECT_FALSE(dev_reg_->CheckRegistration(&error));
+  EXPECT_EQ(1, transport_->GetRequestCount());
+  EXPECT_TRUE(error->HasError(buffet::kErrorDomainOAuth2,
+                              "invalid_grant"));
+  EXPECT_EQ(RegistrationStatus::kInvalidCredentials,
+            dev_reg_->GetRegistrationStatus());
+}
+
 TEST_F(DeviceRegistrationInfoTest, GetDeviceInfo) {
   SetDefaultDeviceRegistration(&data_);
   storage_->Save(&data_);
diff --git a/buffet/registration_status.cc b/buffet/registration_status.cc
index 4fb1721..3b44ae3 100644
--- a/buffet/registration_status.cc
+++ b/buffet/registration_status.cc
@@ -18,6 +18,8 @@
       return "registering";
     case RegistrationStatus::kRegistered:
       return "registered";
+    case RegistrationStatus::kInvalidCredentials:
+      return "invalid_credentials";
   }
   return "unknown";
 }
diff --git a/buffet/registration_status.h b/buffet/registration_status.h
index fa2e2cb..eee0c81 100644
--- a/buffet/registration_status.h
+++ b/buffet/registration_status.h
@@ -16,6 +16,7 @@
   kUnregistered,  // We have no credentials.
   kRegistering,  // We've just been given credentials.
   kRegistered,  // We're registered and online.
+  kInvalidCredentials,  // Our registration has been revoked.
 };
 
 std::string StatusToString(RegistrationStatus status);