diff --git a/backend/app/auth.py b/backend/app/auth.py
index 720563d..f8e74d8 100644
--- a/backend/app/auth.py
+++ b/backend/app/auth.py
@@ -86,6 +86,7 @@ def get_introspection_endpoint() -> Optional[str]:
 def introspect_token(token: str) -> Dict[str, Any]:
     introspection_endpoint = get_introspection_endpoint()
     if not introspection_endpoint:
+        logger.error("Introspection endpoint not available")
         raise HTTPException(status_code=401, detail="Unable to introspect token")
 
     data = {"token": token, "token_type_hint": "access_token"}
@@ -98,6 +99,9 @@ def introspect_token(token: str) -> Dict[str, Any]:
     with httpx.Client(timeout=10.0) as client:
         response = client.post(introspection_endpoint, data=data, headers={"Accept": "application/json"}, auth=auth)
 
+    logger.debug("Introspection request to %s returned %s", introspection_endpoint, response.status_code)
+    logger.debug("Introspection response text: %s", response.text)
+
     if response.status_code != 200:
         raise HTTPException(status_code=401, detail="Unable to introspect token")
 
@@ -120,6 +124,7 @@ async def validate_token(credentials: HTTPAuthorizationCredentials = Security(se
         key = get_signing_key(token)
         public_key = jwk.construct(key)
         discovery = get_discovery()
+        logger.debug("Validating token with JWKS; issuer=%s, audience=%s", discovery.get("issuer"), settings.oidc_audience)
         # Only pass `audience` to the decoder if configured. Some providers
         # (or local development setups) may not include the aud claim in a
         # way that matches your API identifier; in that case leave
@@ -132,14 +137,11 @@ async def validate_token(credentials: HTTPAuthorizationCredentials = Security(se
             jwt_kwargs["audience"] = settings.oidc_audience
 
         verified = jwt.decode(token, public_key, **jwt_kwargs)
+        logger.debug("JWT validation succeeded; claims=%s", verified)
     except JWTError:
         logger.exception("JWT validation failed, attempting introspection")
         verified = introspect_token(token)
-
-    try:
-        return TokenClaims(**verified)
-    except Exception as exc:
-        raise HTTPException(status_code=401, detail="Unable to parse token claims") from exc
+        logger.debug("Introspection succeeded; claims=%s", verified)
 
     try:
         return TokenClaims(**verified)
diff --git a/backend/app/main.py b/backend/app/main.py
index 459e89a..d504d49 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -119,4 +119,5 @@ async def auth_callback(payload: AuthCallbackRequest):
 
 @app.post("/chat", response_class=StreamingResponse)
 async def chat(request: ChatRequest, token=Depends(validate_token)):
+    logger.debug("Chat request authenticated: %s", token.dict())
     return StreamingResponse(event_stream(request), media_type="text/event-stream")
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 0ea91cd..0fc0488 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -165,7 +165,7 @@ async function handleRedirectCallback(): Promise<string | null> {
   })
 
   const result = await response.json()
-  const token = result.id_token || result.access_token
+  const token = result.access_token || result.id_token
   if (response.ok && token) {
     setLocalToken(token)
     return token