diff --git a/src/cloudron.js b/src/cloudron.js
index 343acadb1..60e64cede 100644
--- a/src/cloudron.js
+++ b/src/cloudron.js
@@ -438,31 +438,26 @@ function getConfig(callback) {
         settings.getCloudronName(function (error, cloudronName) {
             if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
 
-            settings.getDeveloperMode(function (error, developerMode) {
-                if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
-
-                callback(null, {
-                    apiServerOrigin: config.apiServerOrigin(),
-                    webServerOrigin: config.webServerOrigin(),
-                    fqdn: config.fqdn(),
-                    adminLocation: config.adminLocation(),
-                    adminFqdn: config.adminFqdn(),
-                    mailFqdn: config.mailFqdn(),
-                    version: config.version(),
-                    update: updateChecker.getUpdateInfo(),
-                    progress: progress.getAll(),
-                    isCustomDomain: config.isCustomDomain(),
-                    isDemo: config.isDemo(),
-                    developerMode: developerMode,
-                    region: result.box.region,
-                    size: result.box.size,
-                    billing: !!result.user.billing,
-                    plan: result.box.plan,
-                    currency: result.user.currency,
-                    memory: os.totalmem(),
-                    provider: config.provider(),
-                    cloudronName: cloudronName
-                });
+            callback(null, {
+                apiServerOrigin: config.apiServerOrigin(),
+                webServerOrigin: config.webServerOrigin(),
+                fqdn: config.fqdn(),
+                adminLocation: config.adminLocation(),
+                adminFqdn: config.adminFqdn(),
+                mailFqdn: config.mailFqdn(),
+                version: config.version(),
+                update: updateChecker.getUpdateInfo(),
+                progress: progress.getAll(),
+                isCustomDomain: config.isCustomDomain(),
+                isDemo: config.isDemo(),
+                region: result.box.region,
+                size: result.box.size,
+                billing: !!result.user.billing,
+                plan: result.box.plan,
+                currency: result.user.currency,
+                memory: os.totalmem(),
+                provider: config.provider(),
+                cloudronName: cloudronName
             });
         });
     });
diff --git a/src/developer.js b/src/developer.js
index 66ccca3d5..7e5c2d397 100644
--- a/src/developer.js
+++ b/src/developer.js
@@ -5,8 +5,6 @@
 exports = module.exports = {
     DeveloperError: DeveloperError,
 
-    isEnabled: isEnabled,
-    setEnabled: setEnabled,
     issueDeveloperToken: issueDeveloperToken
 };
 
@@ -15,7 +13,6 @@ var assert = require('assert'),
     constants = require('./constants.js'),
     eventlog = require('./eventlog.js'),
     tokendb = require('./tokendb.js'),
-    settings = require('./settings.js'),
     util = require('util');
 
 function DeveloperError(reason, errorOrMessage) {
@@ -40,29 +37,6 @@ util.inherits(DeveloperError, Error);
 DeveloperError.INTERNAL_ERROR = 'Internal Error';
 DeveloperError.EXTERNAL_ERROR = 'External Error';
 
-function isEnabled(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    settings.getDeveloperMode(function (error, enabled) {
-        if (error) return callback(new DeveloperError(DeveloperError.INTERNAL_ERROR, error));
-        callback(null, enabled);
-    });
-}
-
-function setEnabled(enabled, auditSource, callback) {
-    assert.strictEqual(typeof enabled, 'boolean');
-    assert.strictEqual(typeof auditSource, 'object');
-    assert.strictEqual(typeof callback, 'function');
-
-    settings.setDeveloperMode(enabled, function (error) {
-        if (error) return callback(new DeveloperError(DeveloperError.INTERNAL_ERROR, error));
-
-        eventlog.add(eventlog.ACTION_CLI_MODE, auditSource, { enabled: enabled });
-
-        callback(null);
-    });
-}
-
 function issueDeveloperToken(user, auditSource, callback) {
     assert.strictEqual(typeof user, 'object');
     assert.strictEqual(typeof auditSource, 'object');
diff --git a/src/routes/developer.js b/src/routes/developer.js
index 16dcca338..ccb727564 100644
--- a/src/routes/developer.js
+++ b/src/routes/developer.js
@@ -1,9 +1,6 @@
 'use strict';
 
 exports = module.exports = {
-    enabled: enabled,
-    setEnabled: setEnabled,
-    status: status,
     login: login
 };
 
@@ -17,27 +14,6 @@ function auditSource(req) {
     return { ip: ip, username: req.user ? req.user.username : null, userId: req.user ? req.user.id : null };
 }
 
-function enabled(req, res, next) {
-    developer.isEnabled(function (error, enabled) {
-        if (enabled) return next();
-        next(new HttpError(412, 'Developer mode not enabled'));
-    });
-}
-
-function setEnabled(req, res, next) {
-    if (typeof req.body.enabled !== 'boolean') return next(new HttpError(400, 'enabled must be boolean'));
-
-    developer.setEnabled(req.body.enabled, auditSource(req), function (error) {
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(200, {}));
-    });
-}
-
-function status(req, res, next) {
-    next(new HttpSuccess(200, {}));
-}
-
 function login(req, res, next) {
     passport.authenticate('local', function (error, user) {
         if (error) return next(new HttpError(500, error));
diff --git a/src/routes/test/apps-test.js b/src/routes/test/apps-test.js
index 17388602a..f1637510b 100644
--- a/src/routes/test/apps-test.js
+++ b/src/routes/test/apps-test.js
@@ -575,29 +575,25 @@ describe('App API', function () {
     });
 
     it('app install succeeds without password but developer token', function (done) {
-        settings.setDeveloperMode(true, function (error) {
-            expect(error).to.be(null);
+        superagent.post(SERVER_URL + '/api/v1/developer/login')
+                .send({ username: USERNAME, password: PASSWORD })
+                .end(function (error, result) {
+            expect(error).to.not.be.ok();
+            expect(result.statusCode).to.equal(200);
+            expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
+            expect(result.body.token).to.be.a('string');
 
-            superagent.post(SERVER_URL + '/api/v1/developer/login')
-                   .send({ username: USERNAME, password: PASSWORD })
-                   .end(function (error, result) {
-                expect(error).to.not.be.ok();
-                expect(result.statusCode).to.equal(200);
-                expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-                expect(result.body.token).to.be.a('string');
+            // overwrite non dev token
+            token = result.body.token;
 
-                // overwrite non dev token
-                token = result.body.token;
-
-                superagent.post(SERVER_URL + '/api/v1/apps/install')
-                       .query({ access_token: token })
-                       .send({ manifest: APP_MANIFEST, location: APP_LOCATION+APP_LOCATION, portBindings: null, accessRestriction: null })
-                       .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
-                    expect(res.body.id).to.be.a('string');
-                    APP_ID = res.body.id;
-                    done();
-                });
+            superagent.post(SERVER_URL + '/api/v1/apps/install')
+                    .query({ access_token: token })
+                    .send({ manifest: APP_MANIFEST, location: APP_LOCATION+APP_LOCATION, portBindings: null, accessRestriction: null })
+                    .end(function (err, res) {
+                expect(res.statusCode).to.equal(202);
+                expect(res.body.id).to.be.a('string');
+                APP_ID = res.body.id;
+                done();
             });
         });
     });
diff --git a/src/routes/test/clients-test.js b/src/routes/test/clients-test.js
index decaeac94..95b0f4207 100644
--- a/src/routes/test/clients-test.js
+++ b/src/routes/test/clients-test.js
@@ -65,141 +65,119 @@ describe('OAuth Clients API', function () {
 
         after(cleanup);
 
-        describe('without developer mode', function () {
-            before(function (done) {
-                settings.setDeveloperMode(false, done);
-            });
-
-            it('fails', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(412);
-                    done();
-                });
+        it('fails without token', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(401);
+                done();
             });
         });
 
-        describe('with developer mode', function () {
-            before(function (done) {
-                settings.setDeveloperMode(true, done);
+        it('fails without appId', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ redirectURI: 'http://foobar.com', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails without token', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(401);
-                    done();
-                });
+        it('fails with empty appId', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: '', redirectURI: 'http://foobar.com', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails without appId', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('fails without scope', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'someApp', redirectURI: 'http://foobar.com' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails with empty appId', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: '', redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('fails with empty scope', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: '' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails without scope', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', redirectURI: 'http://foobar.com' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('fails without redirectURI', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'someApp', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails with empty scope', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: '' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('fails with empty redirectURI', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'someApp', redirectURI: '', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails without redirectURI', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('fails with malformed redirectURI', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'someApp', redirectURI: 'foobar', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails with empty redirectURI', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', redirectURI: '', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('fails with invalid name', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: '$"$%^45asdfasdfadf.adf.', redirectURI: 'http://foobar.com', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
             });
+        });
 
-            it('fails with malformed redirectURI', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', redirectURI: 'foobar', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
+        it('succeeds with dash', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'fo-1234-bar', redirectURI: 'http://foobar.com', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(201);
+                done();
             });
+        });
 
-            it('fails with invalid name', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: '$"$%^45asdfasdfadf.adf.', redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(400);
-                    done();
-                });
-            });
+        it('succeeds', function (done) {
+            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    .query({ access_token: token })
+                    .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(201);
+                expect(result.body.id).to.be.a('string');
+                expect(result.body.appId).to.be.a('string');
+                expect(result.body.redirectURI).to.be.a('string');
+                expect(result.body.clientSecret).to.be.a('string');
+                expect(result.body.scope).to.be.a('string');
+                expect(result.body.type).to.equal(clients.TYPE_EXTERNAL);
 
-            it('succeeds with dash', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'fo-1234-bar', redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(201);
-                    done();
-                });
-            });
-
-            it('succeeds', function (done) {
-                superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                       .query({ access_token: token })
-                       .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(201);
-                    expect(result.body.id).to.be.a('string');
-                    expect(result.body.appId).to.be.a('string');
-                    expect(result.body.redirectURI).to.be.a('string');
-                    expect(result.body.clientSecret).to.be.a('string');
-                    expect(result.body.scope).to.be.a('string');
-                    expect(result.body.type).to.equal(clients.TYPE_EXTERNAL);
-
-                    done();
-                });
+                done();
             });
         });
     });
@@ -236,8 +214,6 @@ describe('OAuth Clients API', function () {
                     });
                 },
 
-                settings.setDeveloperMode.bind(null, true),
-
                 function (callback) {
                     superagent.post(SERVER_URL + '/api/v1/oauth/clients')
                            .query({ access_token: token })
@@ -255,52 +231,31 @@ describe('OAuth Clients API', function () {
 
         after(cleanup);
 
-        describe('without developer mode', function () {
-            before(function (done) {
-                settings.setDeveloperMode(false, done);
-            });
-
-            it('fails', function (done) {
-                superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(412);
-                    done();
-                });
+        it('fails without token', function (done) {
+            superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(401);
+                done();
             });
         });
 
-        describe('with developer mode', function () {
-            before(function (done) {
-                settings.setDeveloperMode(true, done);
+
+        it('fails with unknown id', function (done) {
+            superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id.toUpperCase())
+                    .query({ access_token: token })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(404);
+                done();
             });
+        });
 
-            it('fails without token', function (done) {
-                superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(401);
-                    done();
-                });
-            });
-
-
-            it('fails with unknown id', function (done) {
-                superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id.toUpperCase())
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(404);
-                    done();
-                });
-            });
-
-            it('succeeds', function (done) {
-                superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(200);
-                    expect(result.body).to.eql(CLIENT_0);
-                    done();
-                });
+        it('succeeds', function (done) {
+            superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+                    .query({ access_token: token })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(200);
+                expect(result.body).to.eql(CLIENT_0);
+                done();
             });
         });
     });
@@ -345,8 +300,6 @@ describe('OAuth Clients API', function () {
                     });
                 },
 
-                settings.setDeveloperMode.bind(null, true),
-
                 function (callback) {
                     superagent.post(SERVER_URL + '/api/v1/oauth/clients')
                            .query({ access_token: token })
@@ -364,94 +317,73 @@ describe('OAuth Clients API', function () {
 
         after(cleanup);
 
-        describe('without developer mode', function () {
-            before(function (done) {
-                settings.setDeveloperMode(false, done);
+        it('fails without token', function (done) {
+            superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(401);
+                done();
             });
+        });
+
+
+        it('fails with unknown id', function (done) {
+            superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id.toUpperCase())
+                    .query({ access_token: token })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(404);
+                done();
+            });
+        });
+
+        it('succeeds', function (done) {
+            superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+                    .query({ access_token: token })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(204);
+
+                superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+                        .query({ access_token: token })
+                        .end(function (error, result) {
+                    expect(result.statusCode).to.equal(404);
 
-            it('fails', function (done) {
-                superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(412);
                     done();
                 });
             });
         });
 
-        describe('with developer mode', function () {
-            before(function (done) {
-                settings.setDeveloperMode(true, done);
-            });
+        it('fails for cid-webadmin', function (done) {
+            superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin')
+                    .query({ access_token: token })
+                    .end(function (error, result) {
+                expect(result.statusCode).to.equal(405);
+
+                superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin')
+                        .query({ access_token: token })
+                        .end(function (error, result) {
+                    expect(result.statusCode).to.equal(200);
 
-            it('fails without token', function (done) {
-                superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(401);
                     done();
                 });
             });
+        });
 
+        it('fails for addon auth client', function (done) {
+            clients.add(CLIENT_1.appId, CLIENT_1.type, CLIENT_1.redirectURI, CLIENT_1.scope, function (error, result) {
+                expect(error).to.equal(null);
 
-            it('fails with unknown id', function (done) {
-                superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id.toUpperCase())
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(404);
-                    done();
-                });
-            });
+                CLIENT_1.id = result.id;
 
-            it('succeeds', function (done) {
-                superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(204);
-
-                    superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
-                           .query({ access_token: token })
-                           .end(function (error, result) {
-                        expect(result.statusCode).to.equal(404);
-
-                        done();
-                   });
-                });
-            });
-
-            it('fails for cid-webadmin', function (done) {
-                superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin')
-                       .query({ access_token: token })
-                       .end(function (error, result) {
+                superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_1.id)
+                        .query({ access_token: token })
+                        .end(function (error, result) {
                     expect(result.statusCode).to.equal(405);
 
-                    superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin')
-                           .query({ access_token: token })
-                           .end(function (error, result) {
+                    superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_1.id)
+                            .query({ access_token: token })
+                            .end(function (error, result) {
                         expect(result.statusCode).to.equal(200);
 
                         done();
-                   });
-                });
-            });
-
-            it('fails for addon auth client', function (done) {
-                clients.add(CLIENT_1.appId, CLIENT_1.type, CLIENT_1.redirectURI, CLIENT_1.scope, function (error, result) {
-                    expect(error).to.equal(null);
-
-                    CLIENT_1.id = result.id;
-
-                    superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_1.id)
-                           .query({ access_token: token })
-                           .end(function (error, result) {
-                        expect(result.statusCode).to.equal(405);
-
-                        superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_1.id)
-                               .query({ access_token: token })
-                               .end(function (error, result) {
-                            expect(result.statusCode).to.equal(200);
-
-                            done();
-                       });
                     });
                 });
             });
diff --git a/src/routes/test/cloudron-test.js b/src/routes/test/cloudron-test.js
index f08acbdd0..56d83ca38 100644
--- a/src/routes/test/cloudron-test.js
+++ b/src/routes/test/cloudron-test.js
@@ -244,7 +244,6 @@ describe('Cloudron', function () {
                     expect(result.body.progress).to.be.an('object');
                     expect(result.body.update).to.be.an('object');
                     expect(result.body.version).to.eql(config.version());
-                    expect(result.body.developerMode).to.be.a('boolean');
                     expect(result.body.size).to.eql(null);
                     expect(result.body.region).to.eql(null);
                     expect(result.body.memory).to.eql(os.totalmem());
@@ -270,7 +269,6 @@ describe('Cloudron', function () {
                     expect(result.body.progress).to.be.an('object');
                     expect(result.body.update).to.be.an('object');
                     expect(result.body.version).to.eql(config.version());
-                    expect(result.body.developerMode).to.be.a('boolean');
                     expect(result.body.size).to.eql('1gb');
                     expect(result.body.region).to.eql('sfo');
                     expect(result.body.memory).to.eql(os.totalmem());
diff --git a/src/routes/test/developer-test.js b/src/routes/test/developer-test.js
index 42d25b8e9..923bc576b 100644
--- a/src/routes/test/developer-test.js
+++ b/src/routes/test/developer-test.js
@@ -34,200 +34,10 @@ function cleanup(done) {
 }
 
 describe('Developer API', function () {
-    describe('isEnabled', function () {
-        before(function (done) {
-            async.series([
-                setup,
-
-                function (callback) {
-                    var scope1 = nock(config.apiServerOrigin()).get('/api/v1/boxes/' + config.fqdn() + '/setup/verify?setupToken=somesetuptoken').reply(200, {});
-                    var scope2 = nock(config.apiServerOrigin()).post('/api/v1/boxes/' + config.fqdn() + '/setup/done?setupToken=somesetuptoken').reply(201, {});
-
-                    superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
-                           .query({ setupToken: 'somesetuptoken' })
-                           .send({ username: USERNAME, password: PASSWORD, email: EMAIL })
-                           .end(function (error, result) {
-                        expect(result).to.be.ok();
-                        expect(scope1.isDone()).to.be.ok();
-                        expect(scope2.isDone()).to.be.ok();
-
-                        // stash token for further use
-                        token = result.body.token;
-
-                        callback();
-                    });
-                },
-            ], done);
-        });
-
-        after(cleanup);
-
-        it('fails without token', function (done) {
-            settings.setDeveloperMode(true, function (error) {
-                expect(error).to.be(null);
-
-                superagent.get(SERVER_URL + '/api/v1/developer')
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(401);
-                    done();
-                });
-            });
-        });
-
-        it('succeeds (enabled)', function (done) {
-            settings.setDeveloperMode(true, function (error) {
-                expect(error).to.be(null);
-
-                superagent.get(SERVER_URL + '/api/v1/developer')
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
-            });
-        });
-
-        it('succeeds (not enabled)', function (done) {
-            settings.setDeveloperMode(false, function (error) {
-                expect(error).to.be(null);
-
-                superagent.get(SERVER_URL + '/api/v1/developer')
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(412);
-                    done();
-                });
-            });
-        });
-    });
-
-    describe('setEnabled', function () {
-        before(function (done) {
-            async.series([
-                setup,
-
-                function (callback) {
-                    var scope1 = nock(config.apiServerOrigin()).get('/api/v1/boxes/' + config.fqdn() + '/setup/verify?setupToken=somesetuptoken').reply(200, {});
-                    var scope2 = nock(config.apiServerOrigin()).post('/api/v1/boxes/' + config.fqdn() + '/setup/done?setupToken=somesetuptoken').reply(201, {});
-
-                    superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
-                           .query({ setupToken: 'somesetuptoken' })
-                           .send({ username: USERNAME, password: PASSWORD, email: EMAIL })
-                           .end(function (error, result) {
-                        expect(result).to.be.ok();
-                        expect(scope1.isDone()).to.be.ok();
-                        expect(scope2.isDone()).to.be.ok();
-
-                        // stash token for further use
-                        token = result.body.token;
-
-                        callback();
-                    });
-                },
-            ], done);
-        });
-
-        after(cleanup);
-
-        it('fails without token', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .send({ enabled: true })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(401);
-                done();
-            });
-        });
-
-        it('fails due to missing password', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ enabled: true })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-        });
-
-        it('fails due to empty password', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ password: '', enabled: true })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(403);
-                done();
-            });
-        });
-
-        it('fails due to wrong password', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ password: PASSWORD.toUpperCase(), enabled: true })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(403);
-                done();
-            });
-        });
-
-        it('fails due to missing enabled property', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ password: PASSWORD })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-        });
-
-        it('fails due to wrong enabled property type', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ password: PASSWORD, enabled: 'true' })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-        });
-
-        it('succeeds enabling', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ password: PASSWORD, enabled: true })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-
-                superagent.get(SERVER_URL + '/api/v1/developer')
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
-            });
-        });
-
-        it('succeeds disabling', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/developer')
-                   .query({ access_token: token })
-                   .send({ password: PASSWORD, enabled: false })
-                   .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-
-                superagent.get(SERVER_URL + '/api/v1/developer')
-                       .query({ access_token: token })
-                       .end(function (error, result) {
-                    expect(result.statusCode).to.equal(412);
-                    done();
-                });
-            });
-        });
-    });
-
     describe('login', function () {
         before(function (done) {
             async.series([
                 setup,
-
-                settings.setDeveloperMode.bind(null, true),
-
                 function (callback) {
                     var scope1 = nock(config.apiServerOrigin()).get('/api/v1/boxes/' + config.fqdn() + '/setup/verify?setupToken=somesetuptoken').reply(200, {});
                     var scope2 = nock(config.apiServerOrigin()).post('/api/v1/boxes/' + config.fqdn() + '/setup/done?setupToken=somesetuptoken').reply(201, {});
@@ -373,9 +183,6 @@ describe('Developer API', function () {
         before(function (done) {
             async.series([
                 setup,
-
-                settings.setDeveloperMode.bind(null, true),
-
                 function (callback) {
                     var scope1 = nock(config.apiServerOrigin()).get('/api/v1/boxes/' + config.fqdn() + '/setup/verify?setupToken=somesetuptoken').reply(200, {});
                     var scope2 = nock(config.apiServerOrigin()).post('/api/v1/boxes/' + config.fqdn() + '/setup/done?setupToken=somesetuptoken').reply(201, {});
diff --git a/src/server.js b/src/server.js
index 6e355eccf..45867e192 100644
--- a/src/server.js
+++ b/src/server.js
@@ -107,9 +107,7 @@ function initializeExpressSync() {
     router.get ('/api/v1/cloudron/avatar', routes.settings.getCloudronAvatar); // this is a public alias for /api/v1/settings/cloudron_avatar
 
     // developer routes
-    router.post('/api/v1/developer', developerScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.developer.setEnabled);
-    router.get ('/api/v1/developer', developerScope, routes.developer.enabled, routes.developer.status);
-    router.post('/api/v1/developer/login', routes.developer.enabled, routes.developer.login);
+    router.post('/api/v1/developer/login', routes.developer.login);
 
     // cloudron routes
     router.get ('/api/v1/cloudron/config', cloudronScope, routes.cloudron.getConfig);
@@ -168,12 +166,12 @@ function initializeExpressSync() {
     router.get ('/api/v1/oauth/dialog/authorize', routes.oauth2.authorization);
     router.post('/api/v1/oauth/token', routes.oauth2.token);
     router.get ('/api/v1/oauth/clients', settingsScope, routes.clients.getAll);
-    router.post('/api/v1/oauth/clients', routes.developer.enabled, settingsScope, routes.clients.add);
-    router.get ('/api/v1/oauth/clients/:clientId', routes.developer.enabled, settingsScope, routes.clients.get);
-    router.post('/api/v1/oauth/clients/:clientId', routes.developer.enabled, settingsScope, routes.clients.add);
-    router.del ('/api/v1/oauth/clients/:clientId', routes.developer.enabled, settingsScope, routes.clients.del);
+    router.post('/api/v1/oauth/clients', settingsScope, routes.clients.add);
+    router.get ('/api/v1/oauth/clients/:clientId', settingsScope, routes.clients.get);
+    router.post('/api/v1/oauth/clients/:clientId', settingsScope, routes.clients.add);
+    router.del ('/api/v1/oauth/clients/:clientId', settingsScope, routes.clients.del);
     router.get ('/api/v1/oauth/clients/:clientId/tokens', settingsScope, routes.clients.getClientTokens);
-    router.post('/api/v1/oauth/clients/:clientId/tokens', routes.developer.enabled, settingsScope, routes.clients.addClientToken);
+    router.post('/api/v1/oauth/clients/:clientId/tokens', settingsScope, routes.clients.addClientToken);
     router.del ('/api/v1/oauth/clients/:clientId/tokens', settingsScope, routes.clients.delClientTokens);
     router.del ('/api/v1/oauth/clients/:clientId/tokens/:tokenId', settingsScope, routes.clients.delToken);
 
@@ -193,7 +191,7 @@ function initializeExpressSync() {
     router.post('/api/v1/apps/:id/start',     appsScope, routes.user.requireAdmin, routes.apps.startApp);
     router.get ('/api/v1/apps/:id/logstream', appsScope, routes.user.requireAdmin, routes.apps.getLogStream);
     router.get ('/api/v1/apps/:id/logs',      appsScope, routes.user.requireAdmin, routes.apps.getLogs);
-    router.get ('/api/v1/apps/:id/exec',      routes.developer.enabled, appsScope, routes.user.requireAdmin, routes.apps.exec);
+    router.get ('/api/v1/apps/:id/exec',      appsScope, routes.user.requireAdmin, routes.apps.exec);
     // websocket cannot do bearer authentication
     router.get ('/api/v1/apps/:id/execws',    routes.oauth2.websocketAuth.bind(null, [ clients.SCOPE_APPS ]), routes.user.requireAdmin, routes.apps.execWebSocket);
     router.post('/api/v1/apps/:id/clone',     appsScope, routes.user.requireAdmin, routes.apps.cloneApp);
diff --git a/src/settings.js b/src/settings.js
index e10515611..d9093046c 100644
--- a/src/settings.js
+++ b/src/settings.js
@@ -18,9 +18,6 @@ exports = module.exports = {
     getCloudronAvatar: getCloudronAvatar,
     setCloudronAvatar: setCloudronAvatar,
 
-    getDeveloperMode: getDeveloperMode,
-    setDeveloperMode: setDeveloperMode,
-
     getDynamicDnsConfig: getDynamicDnsConfig,
     setDynamicDnsConfig: setDynamicDnsConfig,
 
@@ -51,7 +48,6 @@ exports = module.exports = {
     getAll: getAll,
 
     // booleans. if you add an entry here, be sure to fix getAll
-    DEVELOPER_MODE_KEY: 'developer_mode',
     DYNAMIC_DNS_KEY: 'dynamic_dns',
     MAIL_FROM_VALIDATION_KEY: 'mail_from_validation',
     EMAIL_DIGEST: 'email_digest',
@@ -97,7 +93,6 @@ var gDefaults = (function () {
     result[exports.AUTOUPDATE_PATTERN_KEY] = '00 00 1,3,5,23 * * *';
     result[exports.TIME_ZONE_KEY] = 'America/Los_Angeles';
     result[exports.CLOUDRON_NAME_KEY] = 'Cloudron';
-    result[exports.DEVELOPER_MODE_KEY] = true;
     result[exports.DYNAMIC_DNS_KEY] = false;
     result[exports.BACKUP_CONFIG_KEY] = {
         provider: 'filesystem',
@@ -264,31 +259,6 @@ function setCloudronAvatar(avatar, callback) {
     return callback(null);
 }
 
-function getDeveloperMode(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    settingsdb.get(exports.DEVELOPER_MODE_KEY, function (error, enabled) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, gDefaults[exports.DEVELOPER_MODE_KEY]);
-        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
-
-        callback(null, !!enabled); // settingsdb holds string values only
-    });
-}
-
-function setDeveloperMode(enabled, callback) {
-    assert.strictEqual(typeof enabled, 'boolean');
-    assert.strictEqual(typeof callback, 'function');
-
-    // settingsdb takes string values only
-    settingsdb.set(exports.DEVELOPER_MODE_KEY, enabled ? 'enabled' : '', function (error) {
-        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
-
-        exports.events.emit(exports.DEVELOPER_MODE_KEY, enabled);
-
-        return callback(null);
-    });
-}
-
 function getDynamicDnsConfig(callback) {
     assert.strictEqual(typeof callback, 'function');
 
@@ -585,7 +555,6 @@ function getAll(callback) {
         settings.forEach(function (setting) { result[setting.name] = setting.value; });
 
         // convert booleans
-        result[exports.DEVELOPER_MODE_KEY] = !!result[exports.DEVELOPER_MODE_KEY];
         result[exports.DYNAMIC_DNS_KEY] = !!result[exports.DYNAMIC_DNS_KEY];
         result[exports.MAIL_FROM_VALIDATION_KEY] = !!result[exports.MAIL_FROM_VALIDATION_KEY];
 
diff --git a/src/test/settings-test.js b/src/test/settings-test.js
index 710ebddca..415732ab5 100644
--- a/src/test/settings-test.js
+++ b/src/test/settings-test.js
@@ -86,29 +86,6 @@ describe('Settings', function () {
             });
         });
 
-        it('can get default developer mode', function (done) {
-            settings.getDeveloperMode(function (error, enabled) {
-                expect(error).to.be(null);
-                expect(enabled).to.equal(true);
-                done();
-            });
-        });
-
-        it('can set developer mode', function (done) {
-            settings.setDeveloperMode(true, function (error) {
-                expect(error).to.be(null);
-                done();
-            });
-        });
-
-        it('can get developer mode', function (done) {
-            settings.getDeveloperMode(function (error, enabled) {
-                expect(error).to.be(null);
-                expect(enabled).to.equal(true);
-                done();
-            });
-        });
-
         it('can set tls config', function (done) {
             settings.setTlsConfig({ provider: 'caas' }, function (error) {
                 expect(error).to.be(null);
diff --git a/webadmin/src/views/appstore.html b/webadmin/src/views/appstore.html
index 1d5572655..0af12f191 100644
--- a/webadmin/src/views/appstore.html
+++ b/webadmin/src/views/appstore.html
@@ -286,7 +286,6 @@
         <a href="" class="appstore-category-link" ng-click="showCategory($event);" ng-class="{'category-active': category === 'project' }" category="project"><i class="fa fa-line-chart"></i> Project Management</a>
         <a href="" class="appstore-category-link" ng-click="showCategory($event);" ng-class="{'category-active': category === 'wiki' }" category="wiki"><i class="fa fa-wikipedia-w"></i> Wiki</a>
         <br/>
-        <!-- <a href="" class="appstore-category-link" ng-click="showCategory($event);" ng-class="{'category-active': category === 'testing' }" category="testing" ng-show="config.developerMode">Testing</a> -->
         <br/>
         <br/>
         <br/>
diff --git a/webadmin/src/views/settings.html b/webadmin/src/views/settings.html
index 91a6e0798..82c2cb1b3 100644
--- a/webadmin/src/views/settings.html
+++ b/webadmin/src/views/settings.html
@@ -91,7 +91,7 @@
                     <fieldset>
                         <input type="password" style="display: none;">
                         <div class="form-group" ng-class="{ 'has-error': (!planChangeForm.password.$dirty && planChange.error.password) || (planChangeForm.password.$dirty && planChangeForm.password.$invalid) }">
-                            <label class="control-label" for="inputDeveloperModeChangePassword">Give your password to verify that you are performing that action</label>
+                            <label class="control-label">Give your password to verify that you are performing that action</label>
                             <div class="control-label" ng-show="(!planChangeForm.password.$dirty && planChange.error.password) || (planChangeForm.password.$dirty && planChangeForm.password.$invalid)">
                                 <small ng-show=" planChangeForm.password.$dirty && planChangeForm.password.$invalid">A password is required</small>
                                 <small ng-show="!planChangeForm.password.$dirty && planChange.error.password">Wrong password</small>