diff --git a/internal/domains/platforms/etsy/etsy.go b/internal/domains/platforms/etsy/etsy.go
index d6ff969..c786a91 100644
--- a/internal/domains/platforms/etsy/etsy.go
+++ b/internal/domains/platforms/etsy/etsy.go
@@ -177,10 +177,6 @@ func (p *Platform) HandleNewAuthCode(ctx context.Context, acctID int64, state, a
 		return false, fmt.Errorf("failed to parse response body: %w", err)
 	}
 
-	fmt.Println("new access token:", accessToken)
-	fmt.Println("new refresh token:", refreshToken)
-	fmt.Println("new token expiration:", expiration)
-
 	// look up user's shop id
 
 	shopID, err := p.getNewUserShopID(ctx, accessToken, userID)
diff --git a/internal/server/login.go b/internal/server/login.go
index c99e2db..2dada0d 100644
--- a/internal/server/login.go
+++ b/internal/server/login.go
@@ -63,7 +63,7 @@ func (s *Server) logoutPage(r *http.Request) (response.Response, error) {
 
 	if ck, err := r.Cookie("access_token"); err == nil && ck != nil {
 		if err := s.auth.DeleteOAuthTokens(r.Context(), ck.Value); err != nil {
-			fmt.Println("[ERROR] failed to delete auth token:", err)
+			s.log.Error("failed to delete auth token", "error", err)
 		}
 	}
 
diff --git a/internal/server/middleware/auth.go b/internal/server/middleware/auth.go
index 61fb2b6..f5d15a8 100644
--- a/internal/server/middleware/auth.go
+++ b/internal/server/middleware/auth.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"time"
 
@@ -18,6 +19,7 @@ import (
 
 type (
 	Auth struct {
+		log         *slog.Logger
 		auth        *authentication.Authenticator
 		newLoginURL LoginURLProviderFunc
 		accts       *accounts.Store
@@ -36,11 +38,13 @@ type (
 )
 
 func NewAuth(
+	logger *slog.Logger,
 	auth *authentication.Authenticator,
 	newLoginURL LoginURLProviderFunc,
 	accts *accounts.Store,
 ) *Auth {
 	return &Auth{
+		log:         logger,
 		auth:        auth,
 		newLoginURL: newLoginURL,
 		accts:       accts,
@@ -133,7 +137,7 @@ func (a *Auth) AuthenticateAndAddIdentity(f response.HandlerFunc, assertions ...
 		if refreshFloor := expiration.Add(-(idTokenLifetime / 4)); refreshFloor.Before(now) {
 			accessToken, expiration, err = a.auth.RefreshAccessToken(ctx, accessToken)
 			if err != nil {
-				fmt.Println("failed to refresh access token:", err)
+				a.log.Warn("failed to refresh access token", "error", err)
 				return response.TemporaryRedirect("/").
 					Body(io.NopCloser(bytes.NewBuffer([]byte(fmt.Sprintf("failed to refresh access token: %v", err))))).
 					Cookie(cookies.Expired("access_token")), nil
diff --git a/internal/server/server.go b/internal/server/server.go
index b661550..7e3811e 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -104,7 +104,9 @@ func NewServer(
 		accts:     accts,
 		etsy:      etsy,
 		auth:      auth,
+		// TODO: shouldn't this ACTUALLY be a middleware?
 		authMiddleware: middleware.NewAuth(
+			logger.WithGroup("auth-middleware"),
 			auth,
 			newLoginURL,
 			accts,
diff --git a/internal/server/webhooks/etsy/webhooks.go b/internal/server/webhooks/etsy/webhooks.go
index 7de0797..1e45d89 100644
--- a/internal/server/webhooks/etsy/webhooks.go
+++ b/internal/server/webhooks/etsy/webhooks.go
@@ -121,7 +121,7 @@ func (h Webhooks) redirectURI(w http.ResponseWriter, r *http.Request) {
 	ok, err := h.etsy.HandleNewAuthCode(ctx, acctID, state, q.Get("code"))
 	if err != nil {
 		w.WriteHeader(http.StatusForbidden)
-		fmt.Println("failed to handle new auth code:", err)
+		h.log.Error("failed to handle new auth code", "error", err)
 		return
 	}
 	if !ok {