diff --git a/src/aare/daq/auth.py b/src/aare/daq/auth.py
index d4a25b89..027d0c82 100644
--- a/src/aare/daq/auth.py
+++ b/src/aare/daq/auth.py
@@ -1,5 +1,6 @@
 import grp
 import ipaddress
+import logging
 import os
 import pwd
 import re
@@ -8,6 +9,8 @@ from datetime import datetime, timedelta, UTC
 from typing import List
 import time
 
+logger = logging.getLogger("aareDAQ")
+
 import jwt
 from fastapi import Depends, HTTPException, Request, status
 from fastapi.security import OAuth2PasswordRequestForm, OAuth2PasswordBearer
@@ -101,7 +104,9 @@ def authenticate_from_proxy_header(request: Request) -> str:
     only the Apache proxy running on the same host can supply it.
     """
     client_host = request.client.host if request.client else None
+    logger.debug(f"[auth] /token client_host={client_host!r} request.client={request.client!r}")
     if not _is_loopback(client_host):
+        logger.warning(f"[auth] Rejecting X-Remote-User: client_host {client_host!r} is not loopback")
         raise AuthenticationException(
             message="X-Remote-User header is only trusted from the localhost proxy",
             status_code=401,