diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72f2257..043ad70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - `query_platform/4` now handles all 2xx status codes as success, returning `{:ok, body}` with the raw response body. Previously only `200` responses with a `%{data: data}` GraphQL structure were treated as success, causing non-GraphQL platform APIs (e.g. ACME) to incorrectly fall through to the error path.
+- Added logging to `verify_peek_auth/2` and `verify_client_request/2` to help debug token verification failures. Warning messages now include the specific error reason and config_id context.
 
 ## [2026-02-27]
 
diff --git a/lib/peek_app_sdk/token.ex b/lib/peek_app_sdk/token.ex
index b2e7ea9..83672be 100644
--- a/lib/peek_app_sdk/token.ex
+++ b/lib/peek_app_sdk/token.ex
@@ -1,5 +1,6 @@
 defmodule PeekAppSDK.Token do
   use Joken.Config
+  require Logger
 
   alias PeekAppSDK.AccountUser
   alias PeekAppSDK.Config
@@ -31,10 +32,12 @@ defmodule PeekAppSDK.Token do
       {:ok, %{"sub" => sub} = claims} ->
         {:ok, sub, claims}
 
-      {:error, _reason} ->
+      {:error, reason} ->
+        Logger.warning("Token verification failed for config_id=#{inspect(config_id)}: #{inspect(reason)}")
         {:error, :unauthorized}
 
-      _ ->
+      other ->
+        Logger.warning("Token verification failed for config_id=#{inspect(config_id)} with unexpected result: #{inspect(other)}")
         {:error, :unauthorized}
     end
   end
@@ -68,13 +71,16 @@ defmodule PeekAppSDK.Token do
         {:ok, %{"sub" => sub} = claims} ->
           {:ok, sub, claims}
 
-        {:error, _reason} ->
+        {:error, reason} ->
+          Logger.warning("Client token verification failed for config_id=#{inspect(config_id)}: #{inspect(reason)}")
           {:error, :unauthorized}
 
-        _ ->
+        other ->
+          Logger.warning("Client token verification failed for config_id=#{inspect(config_id)} with unexpected result: #{inspect(other)}")
           {:error, :unauthorized}
       end
     else
+      Logger.warning("Client token verification failed for config_id=#{inspect(config_id)}: client_secret_token not configured")
       {:error, :unauthorized}
     end
   end