diff --git a/package.json b/package.json
index 9ac6f68..f039df6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.28",
+  "version": "0.5.29",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/src/routes/oidc.js b/src/routes/oidc.js
index 49986db..41de05b 100644
--- a/src/routes/oidc.js
+++ b/src/routes/oidc.js
@@ -48,7 +48,9 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
 
     try {
       // Обмен code на токен (через IAM / Keycloak)
-      const tokenData = await auth.exchangeCode(code);
+      const tokenData = await auth.exchangeCode(code).catch(e => {
+        throw new Error('Code exchange failed: ' + (e.message || e) + ' [KC_BASE_URL=' + process.env.KC_BASE_URL + ', code=' + (code || '').slice(0, 8) + '...]');
+      });
       const accessToken = tokenData.accessToken;
 
       if (!accessToken) throw new Error('No access_token in response');