diff --git a/lua/pending/sync/gcal.lua b/lua/pending/sync/gcal.lua
index 53a9111..bddb461 100644
--- a/lua/pending/sync/gcal.lua
+++ b/lua/pending/sync/gcal.lua
@@ -146,6 +146,8 @@ local function with_token(callback)
           local fresh = client:get_access_token()
           if fresh then
             callback(fresh)
+          else
+            log.error(client.name .. ': authorization failed or was cancelled')
           end
         end)
       end)
diff --git a/lua/pending/sync/gtasks.lua b/lua/pending/sync/gtasks.lua
index 1bf3848..d1ae10f 100644
--- a/lua/pending/sync/gtasks.lua
+++ b/lua/pending/sync/gtasks.lua
@@ -362,6 +362,8 @@ local function with_token(callback)
           local fresh = client:get_access_token()
           if fresh then
             callback(fresh)
+          else
+            log.error(client.name .. ': authorization failed or was cancelled')
           end
         end)
       end)
diff --git a/lua/pending/sync/oauth.lua b/lua/pending/sync/oauth.lua
index 9e13870..cb490e4 100644
--- a/lua/pending/sync/oauth.lua
+++ b/lua/pending/sync/oauth.lua
@@ -252,7 +252,7 @@ function OAuthClient:get_access_token()
   if now - obtained > expires - 60 then
     tokens = self:refresh_access_token(creds, tokens)
     if not tokens then
-      log.error('Failed to refresh access token.')
+      log.error(self.name .. ': token refresh failed — re-authenticating...')
       return nil
     end
   end
@@ -349,6 +349,10 @@ end
 ---@return nil
 function OAuthClient:auth(on_complete)
   local creds = self:resolve_credentials()
+  if creds.client_id == BUNDLED_CLIENT_ID then
+    log.error(self.name .. ': no credentials configured — run :Pending ' .. self.name .. ' setup')
+    return
+  end
   local port = self.port
 
   local verifier_chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~'