I noticed that the Logging page doesn't mention auth_logs – after a little trial and error, I found them super helpful in getting to the bottom of some bad requests. it sounds like documentation improvements are already on the team's radar, but just wanted to suggest a small template that we found useful for analyzing different auth errors:

select
  count(timestamp) as count_errors,
  regexp_substr(event_message, 'error="(.*?)(?:"|: &{POST)') as error
from auth_logs
where regexp_contains(event_message, 'error=')
group by regexp_substr(event_message, 'error="(.*?)(?:"|: &{POST)')