diff --git a/src/main/java/land/oras/auth/HttpClient.java b/src/main/java/land/oras/auth/HttpClient.java
index af95e1ff..9cd03911 100644
--- a/src/main/java/land/oras/auth/HttpClient.java
+++ b/src/main/java/land/oras/auth/HttpClient.java
@@ -583,11 +583,13 @@ public <T> TokenResponse refreshToken(
         String wwwAuthHeader = response.headers().getOrDefault(Const.WWW_AUTHENTICATE_HEADER.toLowerCase(), "");
         LOG.debug("WWW-Authenticate header: {}", wwwAuthHeader);
         if (wwwAuthHeader.isEmpty()) {
+            logResponse(response);
             throw new OrasException(response.statusCode(), "No WWW-Authenticate header found in response");
         }
 
         Matcher matcher = WWW_AUTH_VALUE_PATTERN.matcher(wwwAuthHeader);
         if (!matcher.matches()) {
+            logResponse(response);
             throw new OrasException(response.statusCode(), "Invalid WWW-Authenticate header");
         }
 
@@ -915,6 +917,21 @@ private <T> ResponseWrapper<T> toResponseWrapper(HttpResponse<T> response, @Null
                 service);
     }
 
+    /**
+     * Log the response
+     * @param response The response
+     */
+    private void logResponse(HttpClient.ResponseWrapper<?> response) {
+        LOG.debug("Status Code: {}", response.statusCode());
+        LOG.debug("Headers: {}", response.headers());
+        LOG.debug("Service: {}", response.service());
+        String contentType = response.headers().get(Const.CONTENT_TYPE_HEADER.toLowerCase());
+        boolean isBinaryResponse = contentType != null && contentType.contains("octet-stream");
+        if (response.response() instanceof String && !isBinaryResponse) {
+            LOG.debug("Response: {}", response.response());
+        }
+    }
+
     /**
      * Logs the request in debug/trace mode
      * @param request The request