diff --git a/paskia/fastapi/oid.py b/paskia/fastapi/oid.py
index ba1304d..bc95a5f 100644
--- a/paskia/fastapi/oid.py
+++ b/paskia/fastapi/oid.py
@@ -401,37 +401,68 @@ async def userinfo(
     Returns claims about the authenticated user.
     Requires Bearer token from /token endpoint.
     """
+    print(f"DEBUG UserInfo: Received request from {request.client.host}")
+    print(f"DEBUG UserInfo: Authorization header present: {bool(credentials)}")
+    
     if not credentials:
+        print("DEBUG UserInfo: No credentials provided")
         raise HTTPException(401, "Bearer token required")
 
+    print(f"DEBUG UserInfo: Token length: {len(credentials.credentials)}")
+    print(f"DEBUG UserInfo: Token prefix: {credentials.credentials[:50]}...")
+
     issuer = _get_issuer(request)
+    print(f"DEBUG UserInfo: Computed issuer: {issuer}")
+    
     payload = oidjwt.decode_access_token(credentials.credentials, issuer)
+    print(f"DEBUG UserInfo: JWT decode result: {payload is not None}")
+    
     if not payload:
+        print("DEBUG UserInfo: JWT decode failed")
         raise HTTPException(401, "Invalid or expired token")
 
+    print(f"DEBUG UserInfo: Decoded payload: {payload}")
+
     # Verify audience is a valid client
     aud = payload.get("aud")
+    print(f"DEBUG UserInfo: Audience claim: {aud}")
+    
     if not aud:
+        print("DEBUG UserInfo: Missing aud claim")
         raise HTTPException(401, "Invalid token (missing aud claim)")
 
     try:
         client_uuid = UUID(aud)
+        print(f"DEBUG UserInfo: Client UUID: {client_uuid}")
     except ValueError:
+        print(f"DEBUG UserInfo: Invalid UUID format: {aud}")
         raise HTTPException(401, "Invalid token (invalid aud format)")
 
-    if not db.data().oid_clients.get(client_uuid):
+    client = db.data().oid_clients.get(client_uuid)
+    print(f"DEBUG UserInfo: Client found: {client is not None}")
+    if not client:
+        print(f"DEBUG UserInfo: Unknown client UUID: {client_uuid}")
         raise HTTPException(401, "Invalid token (unknown client)")
 
     # Get user
+    sub = payload.get("sub")
+    print(f"DEBUG UserInfo: Subject claim: {sub}")
+    
     try:
-        user_uuid = UUID(payload["sub"])
-    except (KeyError, ValueError):
+        user_uuid = UUID(sub)
+        print(f"DEBUG UserInfo: User UUID: {user_uuid}")
+    except (KeyError, ValueError) as e:
+        print(f"DEBUG UserInfo: Invalid sub claim: {e}")
         raise HTTPException(401, "Invalid token")
 
     user = db.data().users.get(user_uuid)
+    print(f"DEBUG UserInfo: User found: {user is not None}")
     if not user:
+        print(f"DEBUG UserInfo: Unknown user UUID: {user_uuid}")
         raise HTTPException(401, "User not found")
 
+    print("DEBUG UserInfo: All validations passed, proceeding with response")
+
     # Get user's permissions scoped to this OIDC client (domain == client UUID)
     role = user.role
     org = role.org