diff --git a/.env.example b/.env.example
index cb72f48..3451c14 100644
--- a/.env.example
+++ b/.env.example
@@ -22,6 +22,10 @@
 # Do not set NODE_ENV=test-local in production (bypasses ethr JWT expiry).
 # NODE_ENV=test-local
 
+# Mount the /debug router (device lookup, manual wakeup send). Default: false.
+# Leave off in production; the routes expose per-device state to any accepted JWT.
+# DEBUG_ENDPOINT=false
+
 # --- SMS notifications (/notify-sms) ---
 
 # Master switch. While false, every /notify-sms route returns 503 SMS_DISABLED
diff --git a/src/env.ts b/src/env.ts
index 21b3c0e..1897c8f 100644
--- a/src/env.ts
+++ b/src/env.ts
@@ -23,6 +23,18 @@ export const PARTNER_URL =
 /** NODE_ENV value that unlocks developer conveniences. Never set in production. */
 export const TEST_LOCAL_ENV = "test-local";
 
+/** Truthy env values for boolean flags: "true"/"1"/"yes"/"on" (case-insensitive). */
+function envFlag(value: string | undefined, fallback: boolean): boolean {
+  if (value === undefined || value.trim().length === 0) return fallback;
+  const normalized = value.trim().toLowerCase();
+  if (["true", "1", "yes", "on"].includes(normalized)) return true;
+  if (["false", "0", "no", "off"].includes(normalized)) return false;
+  return fallback;
+}
+
+/** Mounts /debug when true. Off unless explicitly enabled. */
+export const DEBUG_ENDPOINT = envFlag(process.env.DEBUG_ENDPOINT, false);
+
 function booleanEnv(name: string, fallback: boolean): boolean {
   const raw = process.env[name];
   if (raw === undefined || raw.length === 0) return fallback;
diff --git a/src/index.ts b/src/index.ts
index 70a8000..7b2a691 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -2,6 +2,7 @@ import { assertSmsConfigured, smsConfig } from "./env.js";
 import cors from "cors";
 import express from "express";
 import "./services/firebase.js";
+import { DEBUG_ENDPOINT } from "./env.js";
 import { debugRouter } from "./routes/debug.js";
 import { notificationsRouter } from "./routes/notifications.js";
 import { notifySmsRouter } from "./routes/notifySms.js";
@@ -31,8 +32,11 @@ app.get("/health", (_req, res) => {
 app.use("/notifications", notificationsRouter);
 app.use("/notify-sms", notifySmsRouter);
 
-// Only include on test environments
-// app.use("/debug", debugRouter);
+// Only include on test environments (DEBUG_ENDPOINT=true)
+if (DEBUG_ENDPOINT) {
+  app.use("/debug", debugRouter);
+  console.log("* Debug endpoints enabled at /debug (DEBUG_ENDPOINT=true)");
+}
 
 assertSmsConfigured();
 
diff --git a/src/middleware/auth.ts b/src/middleware/auth.ts
index 063d7d3..7547ea1 100644
--- a/src/middleware/auth.ts
+++ b/src/middleware/auth.ts
@@ -148,12 +148,13 @@ export async function requireEndorserAuth(
   const errorTime = new Date().toISOString();
   const did = req.did ?? "(unknown)";
 
-  if (result.reason === "unavailable") {
+  if (result.reason !== "unauthorized") {
     log.info("[Auth] Endorser unavailable");
     log.error(
       "[Auth] Endorser auth check unavailable at",
       errorTime + ", did:",
-      did
+      did + ", reason:",
+      result.reason
     );
     res.status(503).json({
       success: false,
diff --git a/src/services/endorserClient.ts b/src/services/endorserClient.ts
index f82bf78..f43ae48 100644
--- a/src/services/endorserClient.ts
+++ b/src/services/endorserClient.ts
@@ -6,7 +6,7 @@ const RATE_LIMITS_PATH = "/api/report/rateLimits";
 
 export type EndorserAuthResult =
   | { ok: true }
-  | { ok: false; reason: "unauthorized" | "unavailable" };
+  | { ok: false; reason: "unauthorized" | "unavailable error" | "unavailable 500" };
 
 function rateLimitsUrl(): string {
   const base = ENDORSER_URL.replace(/\/+$/, "");
@@ -37,7 +37,7 @@ export async function checkAuth(jwt: string): Promise<EndorserAuthResult> {
       url + ":",
       errorMessage(err)
     );
-    return { ok: false, reason: "unavailable" };
+    return { ok: false, reason: "unavailable error" };
   }
 
   if (response.ok) {
@@ -51,7 +51,7 @@ export async function checkAuth(jwt: string): Promise<EndorserAuthResult> {
       url + ", status",
       response.status
     );
-    return { ok: false, reason: "unavailable" };
+    return { ok: false, reason: "unavailable 500" };
   }
 
   // 4xx: JWT rejected or user not registered on Endorser.