diff --git a/src/Application.hs b/src/Application.hs
index 7a53057e7..bc1ea2bec 100644
--- a/src/Application.hs
+++ b/src/Application.hs
@@ -672,7 +672,7 @@ appMain = runResourceT $ do
     foundation <- makeFoundation settings
 
     runAppLoggingT foundation $ do
-      $logErrorS "AppSettings" $ tshow settings
+      $logDebugS "AppSettings" $ tshow settings
 
       $logInfoS "setup" "Job-Handling"
       handleJobs foundation
diff --git a/src/Auth/OAuth2.hs b/src/Auth/OAuth2.hs
index fa1291407..97495c1d7 100644
--- a/src/Auth/OAuth2.hs
+++ b/src/Auth/OAuth2.hs
@@ -212,7 +212,7 @@ refreshOAuth2Token (_, rToken) url secure
         clientSecret <- liftIO $ fromJust <$> lookupEnv "CLIENT_SECRET"
         return $ body ++ [("client_id", fromString clientID), ("client_secret", fromString clientSecret), scopeParam " " ["openid","profile"," offline_access"]] -- TODO read from config
       else return $ scopeParam " " ["openid","profile","offline_access"] : body -- TODO read from config
-    $logErrorS "\27[31mAdmin Handler\27[0m" $ tshow (requestBody $ urlEncodedBody body' req{ secure = secure })
+    $logDebugS "\27[31mAdmin Handler\27[0m" $ tshow (requestBody $ urlEncodedBody body' req{ secure = secure })
     eResult <- lift $ getResponseBody <$> httpJSONEither @m @OAuth2Token (urlEncodedBody body' req{ secure = secure })
     case eResult of
       Left x -> throwE $ UserDataJSONException x
@@ -241,6 +241,6 @@ singleSignOut mRedirect = do
       endpoint = case mRedirect of
         Just r -> base <> "?post_logout_redirect_uri=" <> r
         Nothing -> base
-  $logErrorS "\n\27[31mSSO\27[0m" endpoint 
+  $logDebugS "\n\27[31mSSO\27[0m" endpoint 
   redirect endpoint
 
diff --git a/src/Foundation/Yesod/Auth.hs b/src/Foundation/Yesod/Auth.hs
index 27a72425b..c15240171 100644
--- a/src/Foundation/Yesod/Auth.hs
+++ b/src/Foundation/Yesod/Auth.hs
@@ -50,14 +50,10 @@ authenticate :: ( MonadHandler m, HandlerSite m ~ UniWorX
              => Creds UniWorX
              -> m (AuthenticationResult UniWorX)
 authenticate creds@Creds{..} = liftHandler . runDB . withReaderT projectBackend $ do
-  $logErrorS "Auth Debug" $ "\a\27[31m" <> tshow creds <> "\27[0m" -- TODO: debug only
+  $logDebugS "Auth Debug" $ "\a\27[31m" <> tshow creds <> "\27[0m"
   setSessionJson SessionOAuth2Token (getAccessToken creds, getRefreshToken creds)
-  sess <- getSession
-  $logErrorS "OAuth session Debug" $ "\27[34m" <> tshow sess <> "\27[0m" -- TODO: debug only
 
   now <- liftIO getCurrentTime
-  userAuthConf <- getsYesod $ view _appUserAuthConf -- TODO: debug only
-  $logErrorS "authenticate AuthConf Debug" $ "\27[31m" <> tshow userAuthConf <> "\27[0m" -- TODO: debug only
 
   let
     uAuth = UniqueAuthentication $ CI.mk credsIdent
diff --git a/src/Handler/SingleSignOut.hs b/src/Handler/SingleSignOut.hs
index 8b89a19d0..ea057b4f0 100644
--- a/src/Handler/SingleSignOut.hs
+++ b/src/Handler/SingleSignOut.hs
@@ -14,7 +14,7 @@ import qualified Network.Wai as W
 
 getSOutR :: Handler Html
 getSOutR = do
-  $logErrorS "\27[31mSOut\27[0m" "Redirect to LogoutR"
+  $logDebugS "\27[31mSOut\27[0m" "Redirect to LogoutR"
   redirect $ AuthR LogoutR
 
 getSSOutR :: Handler Html
@@ -26,6 +26,6 @@ getSSOutR = do
         _ -> error "approt implementation changed"
       url = decodeUtf8 . urlEncode True . encodeUtf8 $ root <> "/" <> redir
   AppSettings{..} <- getsYesod appSettings'
-  $logErrorS "\27[31mSSOut\27[0m" "Redirect to auth server"
+  $logDebugS "\27[31mSSOut\27[0m" "Redirect to auth server"
   if appSingleSignOn then singleSignOut (Just url) else redirect (AuthR LogoutR)