diff --git a/appview/oauth/handler.go b/appview/oauth/handler.go
--- a/appview/oauth/handler.go
+++ b/appview/oauth/handler.go
@@ -5,7 +5,6 @@
 	"context"
 	"encoding/json"
 	"fmt"
-	"log"
 	"net/http"
 	"slices"
 	"time"
@@ -43,7 +42,7 @@
 	jwks := o.Config.OAuth.Jwks
 	pubKey, err := pubKeyFromJwk(jwks)
 	if err != nil {
-		log.Printf("error parsing public key: %v", err)
+		o.Logger.Error("error parsing public key", "err", err)
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
@@ -71,7 +70,7 @@
 		return
 	}
 
-	log.Println("session saved successfully")
+	o.Logger.Debug("session saved successfully")
 	go o.addToDefaultKnot(sessData.AccountDID.String())
 	go o.addToDefaultSpindle(sessData.AccountDID.String())
 
@@ -81,7 +80,7 @@
 			Event:      "signin",
 		})
 		if err != nil {
-			log.Println("failed to enqueue posthog event:", err)
+			o.Logger.Error("failed to enqueue posthog event", "err", err)
 		}
 	}
 
@@ -89,6 +88,8 @@
 }
 
 func (o *OAuth) addToDefaultSpindle(did string) {
+	l := o.Logger.With("subject", did)
+
 	// use the tangled.sh app password to get an accessJwt
 	// and create an sh.tangled.spindle.member record with that
 	spindleMembers, err := db.GetSpindleMembers(
@@ -97,19 +98,19 @@
 		db.FilterEq("subject", did),
 	)
 	if err != nil {
-		log.Printf("failed to get spindle members for did %s: %v", did, err)
+		l.Error("failed to get spindle members", "err", err)
 		return
 	}
 
 	if len(spindleMembers) != 0 {
-		log.Printf("did %s is already a member of the default spindle", did)
+		l.Warn("already a member of the default spindle")
 		return
 	}
 
-	log.Printf("adding %s to default spindle", did)
+	l.Debug("adding to default spindle")
 	session, err := o.createAppPasswordSession(o.Config.Core.AppPassword, consts.TangledDid)
 	if err != nil {
-		log.Printf("failed to create session: %s", err)
+		l.Error("failed to create session", "err", err)
 		return
 	}
 
@@ -121,32 +122,34 @@
 	}
 
 	if err := session.putRecord(record, tangled.SpindleMemberNSID); err != nil {
-		log.Printf("failed to add member to default spindle: %s", err)
+		l.Error("failed to add to default spindle", "err", err)
 		return
 	}
 
-	log.Printf("successfully added %s to default spindle", did)
+	l.Debug("successfully added to default spindle", "did", did)
 }
 
 func (o *OAuth) addToDefaultKnot(did string) {
+	l := o.Logger.With("subject", did)
+
 	// use the tangled.sh app password to get an accessJwt
 	// and create an sh.tangled.spindle.member record with that
 
 	allKnots, err := o.Enforcer.GetKnotsForUser(did)
 	if err != nil {
-		log.Printf("failed to get knot members for did %s: %v", did, err)
+		l.Error("failed to get knot members for did", "err", err)
 		return
 	}
 
 	if slices.Contains(allKnots, consts.DefaultKnot) {
-		log.Printf("did %s is already a member of the default knot", did)
+		l.Warn("already a member of the default knot")
 		return
 	}
 
-	log.Printf("adding %s to default knot", did)
+	l.Debug("addings to default knot")
 	session, err := o.createAppPasswordSession(o.Config.Core.TmpAltAppPassword, consts.IcyDid)
 	if err != nil {
-		log.Printf("failed to create session: %s", err)
+		l.Error("failed to create session", "err", err)
 		return
 	}
 
@@ -158,16 +161,16 @@
 	}
 
 	if err := session.putRecord(record, tangled.KnotMemberNSID); err != nil {
-		log.Printf("failed to add member to default knot: %s", err)
+		l.Error("failed to add to default knot", "err", err)
 		return
 	}
 
 	if err := o.Enforcer.AddKnotMember(consts.DefaultKnot, did); err != nil {
-		log.Printf("failed to set up enforcer rules: %s", err)
+		l.Error("failed to set up enforcer rules", "err", err)
 		return
 	}
 
-	log.Printf("successfully added %s to default Knot", did)
+	l.Debug("successfully addeds to default Knot")
 }
 
 // create a session using apppasswords
diff --git a/appview/oauth/oauth.go b/appview/oauth/oauth.go
--- a/appview/oauth/oauth.go
+++ b/appview/oauth/oauth.go
@@ -3,6 +3,7 @@
 import (
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"time"
 
@@ -20,7 +21,19 @@
 	"tangled.org/core/rbac"
 )
 
-func New(config *config.Config, ph posthog.Client, db *db.DB, enforcer *rbac.Enforcer, res *idresolver.Resolver) (*OAuth, error) {
+type OAuth struct {
+	ClientApp  *oauth.ClientApp
+	SessStore  *sessions.CookieStore
+	Config     *config.Config
+	JwksUri    string
+	Posthog    posthog.Client
+	Db         *db.DB
+	Enforcer   *rbac.Enforcer
+	IdResolver *idresolver.Resolver
+	Logger     *slog.Logger
+}
+
+func New(config *config.Config, ph posthog.Client, db *db.DB, enforcer *rbac.Enforcer, res *idresolver.Resolver, logger *slog.Logger) (*OAuth, error) {
 
 	var oauthConfig oauth.ClientConfig
 	var clientUri string
@@ -54,18 +67,8 @@
 		Db:         db,
 		Enforcer:   enforcer,
 		IdResolver: res,
+		Logger:     logger,
 	}, nil
-}
-
-type OAuth struct {
-	ClientApp  *oauth.ClientApp
-	SessStore  *sessions.CookieStore
-	Config     *config.Config
-	JwksUri    string
-	Posthog    posthog.Client
-	Db         *db.DB
-	Enforcer   *rbac.Enforcer
-	IdResolver *idresolver.Resolver
 }
 
 func (o *OAuth) SaveSession(w http.ResponseWriter, r *http.Request, sessData *oauth.ClientSessionData) error {
diff --git a/appview/state/state.go b/appview/state/state.go
--- a/appview/state/state.go
+++ b/appview/state/state.go
@@ -82,7 +82,7 @@
 	}
 
 	pages := pages.NewPages(config, res, log.SubLogger(logger, "pages"))
-	oauth, err := oauth.New(config, posthog, d, enforcer, res)
+	oauth, err := oauth.New(config, posthog, d, enforcer, res, log.SubLogger(logger, "oauth"))
 	if err != nil {
 		return nil, fmt.Errorf("failed to start oauth handler: %w", err)
 	}