diff --git a/pkg/issuer/issuer.go b/pkg/issuer/issuer.go
index 33f9f04..59ae185 100644
--- a/pkg/issuer/issuer.go
+++ b/pkg/issuer/issuer.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"log/slog"
 	"net/http"
 	"os"
@@ -54,6 +55,14 @@ func (iss *tokenIssuer) issue(ctx context.Context, config Config) (string, int,
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+
+		slog.Error("failed to issue access token", "body", string(b))
+
+		return "", 0, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
+	}
+
 	var token tokenResponse
 	if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
 		return "", 0, fmt.Errorf("failed to decode response: %w", err)