Users report that an API endpoint returns 401 or 403 unexpectedly. How would you debug it?

In production I trace the decision in stages: route selection, scheme selection, authentication result, claims transformation, policy evaluation, resource loading, and final tenant or ownership check. I compare environment-specific issuer, audience, keys, clock, and claim mapping because configuration drift often explains failures that cannot be reproduced locally. For JWT APIs the authentication challenge carries the appropriate WWW-Authenticate header; an authenticated denial becomes 403, while a resource may deliberately appear as 404 when revealing its existence is unsafe. Tests cover missing, malformed, expired, wrong-audience, and valid tokens, plus allowed, forbidden, disabled-account, and cross-tenant cases. Metrics separate 401 and 403 rates by endpoint and deployment so a sudden change points to identity configuration or authorization policy rather than a vague login failure.