diff --git a/oauth/index.js b/oauth/index.js
index 8dd0210..1e4162b 100644
--- a/oauth/index.js
+++ b/oauth/index.js
@@ -31,11 +31,13 @@
       } else if (config.allowNoAuthorization) {
         return next();
       } else {
+        debug('missing_authorization');
         return sendError(req, res, next, logger, stats, 'missing_authorization', 'Missing Authorization header');
       }
     } else {
       var header = authHeaderRegex.exec(req.headers[authHeaderName]);
       if (!header || header.length < 2) {
+        debug('Invalid Authorization Header');
         return sendError(req, res, next, logger, stats, 'invalid_request', 'Invalid Authorization header');
       }
 
@@ -73,8 +75,14 @@
       json: { 'apiKey': apiKey },
       headers: { 'x-dna-api-key': apiKey }
     }, function (err, response, body) {
-      if (err) return sendError(req, res, next, logger, stats, 'gateway_timeout', err.message);
-      if (response.statusCode !== 200) return sendError(req, res, next, logger, stats, 'access_denied', response.statusMessage);
+      if (err) {
+        debug('verify apikey gateway timeout');
+        return sendError(req, res, next, logger, stats, 'gateway_timeout', err.message);
+      }
+      if (response.statusCode !== 200) {
+        debug('verify apikey access_denied');
+        return sendError(req, res, next, logger, stats, 'access_denied', response.statusMessage);
+      }
       verify(body, config, logger, stats, middleware, req, res, next, apiKey);
     });
   }
@@ -99,10 +107,12 @@
         } else {
 
           if (err.name === 'TokenExpiredError') {
+            debug('Token expired error');
             return sendError(req, res, next, logger, stats, 'access_denied');
           }
 
           // todo: check other properties and/or give client more info?
+          debug('invalid token');
           return sendError(req, res, next, logger, stats, 'invalid_token');
         }
       }
@@ -163,12 +173,12 @@
 // then check if that proxy is one of the authorized proxies in bootstrap
 const checkIfAuthorized = module.exports.checkIfAuthorized = function checkIfAuthorized(config, urlPath, proxy, decodedToken) {
 
-  if (!decodedToken.api_product_list) { return false; }
+  if (!decodedToken.api_product_list) { debug('no api product list'); return false; }
 
   return decodedToken.api_product_list.some(function (product) {
 
     const validProxyNames = config.product_to_proxy[product];
-    if (!validProxyNames) { return false; }
+    if (!validProxyNames) { debug('no proxies found for product'); return false; }
 
     const apiproxies = config.product_to_api_resource[product];
     var matchesProxyRules = false;
@@ -176,6 +186,7 @@
       apiproxies.forEach(function (tempApiProxy) {
           if(matchesProxyRules){
             //found one
+            debug('found matching proxy rule');
             return;
           }
           const apiproxy = tempApiProxy.includes(proxy.base_path)