app/api/auth/callback/route.ts

@@ -68,7 +68,12 @@ export async function GET(request: NextRequest) {
     });
     response.cookies.set(OIDC_STATE_COOKIE, '', { path: '/', maxAge: 0 });
     return response;
-  } catch {
+  } catch (error: unknown) {
+    // Codes only (e.g. token_exchange_failed), never tokens or claims.
+    console.error(
+      '[0pt-auth] oidc callback failed:',
+      error instanceof Error ? error.message : 'unknown_error',
+    );
     return fail('verification_failed');
   }
 }