add logging for token validation errors

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - `query_platform/4` now handles all 2xx status codes as success, returning `{:ok, body}` with the raw response body. Previously only `200` responses with a `%{data: data}` GraphQL structure were treated as success, causing non-GraphQL platform APIs (e.g. ACME) to incorrectly fall through to the error path.
+- Added logging to `verify_peek_auth/2` and `verify_client_request/2` to help debug token verification failures. Warning messages now include the specific error reason and config_id context.
 
 ## [2026-02-27]
 

lib/peek_app_sdk/token.ex

@@ -1,5 +1,6 @@
 defmodule PeekAppSDK.Token do
   use Joken.Config
+  require Logger
 
   alias PeekAppSDK.AccountUser
   alias PeekAppSDK.Config
@@ -31,10 +32,12 @@ defmodule PeekAppSDK.Token do
       {:ok, %{"sub" => sub} = claims} ->
         {:ok, sub, claims}
 
-      {:error, _reason} ->
+      {:error, reason} ->
+        Logger.warning("Token verification failed for config_id=#{inspect(config_id)}: #{inspect(reason)}")
         {:error, :unauthorized}
 
-      _ ->
+      other ->
+        Logger.warning("Token verification failed for config_id=#{inspect(config_id)} with unexpected result: #{inspect(other)}")
         {:error, :unauthorized}
     end
   end
@@ -68,13 +71,16 @@ defmodule PeekAppSDK.Token do
         {:ok, %{"sub" => sub} = claims} ->
           {:ok, sub, claims}
 
-        {:error, _reason} ->
+        {:error, reason} ->
+          Logger.warning("Client token verification failed for config_id=#{inspect(config_id)}: #{inspect(reason)}")
           {:error, :unauthorized}
 
-        _ ->
+        other ->
+          Logger.warning("Client token verification failed for config_id=#{inspect(config_id)} with unexpected result: #{inspect(other)}")
           {:error, :unauthorized}
       end
     else
+      Logger.warning("Client token verification failed for config_id=#{inspect(config_id)}: client_secret_token not configured")
       {:error, :unauthorized}
     end
   end