paskia/fastapi/oid.py

@@ -414,6 +414,16 @@ async def userinfo(
     issuer = _get_issuer(request)
     print(f"DEBUG UserInfo: Computed issuer: {issuer}")
     
+    # Try to decode without verification to see token contents
+    try:
+        import jwt
+        unverified_payload = jwt.decode(credentials.credentials, options={"verify_signature": False})
+        print(f"DEBUG UserInfo: Unverified payload: {unverified_payload}")
+        print(f"DEBUG UserInfo: Token issuer claim: {unverified_payload.get('iss')}")
+        print(f"DEBUG UserInfo: Token audience claim: {unverified_payload.get('aud')}")
+    except Exception as e:
+        print(f"DEBUG UserInfo: Failed to decode unverified: {e}")
+    
     payload = oidjwt.decode_access_token(credentials.credentials, issuer)
     print(f"DEBUG UserInfo: JWT decode result: {payload is not None}")
     

paskia/util/oidjwt.py

@@ -193,5 +193,6 @@ def decode_access_token(
             issuer=issuer,
             audience=audience,  # PyJWT handles None by skipping verification
         )
-    except jwt.PyJWTError:
+    except jwt.PyJWTError as e:
+        print(f"DEBUG JWT decode error: {e}")
         return None