diff --git a/src/domains/auth/oidc.py b/src/domains/auth/oidc.py
index a052a3d..74e1708 100644
--- a/src/domains/auth/oidc.py
+++ b/src/domains/auth/oidc.py
@@ -190,8 +190,9 @@ async def get_current_user(
             raise HTTPException(status_code=401, detail="Invalid token format")
 
         # Validate issuer is in allowed list
+        logger.debug(f"Token issuer: {token_issuer}, allowed issuers: {oidc_config.issuers}")
         if not oidc_config.is_valid_issuer(token_issuer):
-            logger.warning(f"Invalid token issuer: {token_issuer}")
+            logger.warning(f"Invalid token issuer: {token_issuer} (allowed: {oidc_config.issuers})")
             raise HTTPException(status_code=401, detail="Invalid token issuer")
 
         # Get JWKS for this specific issuer
@@ -315,12 +316,14 @@ async def get_optional_user(
         }
 
     if not credentials:
+        logger.debug("No credentials provided for optional auth")
         return None
 
     try:
         return await get_current_user(credentials)
-    except HTTPException:
-        # Invalid token - return None instead of raising
+    except HTTPException as e:
+        # Invalid token - log and return None instead of raising
+        logger.warning(f"Optional auth failed: {e.detail}")
         return None