diff --git a/Dockerfile b/Dockerfile
index 3d34820..92c46b0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,32 +1,16 @@
-FROM node:22
+FROM golang:1.24
 
-ENV GO_VERSION=1.24.4
-
-ADD https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip .
-ADD https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz .
-
-RUN <<EOF
-  unzip awscli-exe-linux-x86_64.zip
-  rm awscli-exe-linux-x86_64.zip
-  ./aws/install
-  rm -rf ./aws
-
-  tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz
-  rm go${GO_VERSION}.linux-amd64.tar.gz
-  ln -s /usr/local/go/bin/go /usr/local/bin/go
-
-  npm install --ignore-scripts --global aws-cdk
-
-  adduser user
-EOF
+RUN adduser user
 
 WORKDIR /src
 
 RUN curl -sSfL --proto "=https" https://raw.githubusercontent.com/cosmtrek/air/master/install.sh | \
-  sh -s -- -b $(go env GOPATH)/bin
+  sh -s -- -b /usr/local/bin && \
+  git config --global --add safe.directory /src
 
 COPY ./ .
-RUN go get ./...
+RUN go get ./... && \
+  git config --global --add safe.directory /src
 
 EXPOSE 8080
 
diff --git a/apikey.go b/apikey.go
index 82b0a4f..78df344 100644
--- a/apikey.go
+++ b/apikey.go
@@ -76,7 +76,8 @@ func (k *ApiKey) IsCorrect(given string) error {
 
 	err := bcrypt.CompareHashAndPassword([]byte(k.HashedSecret), []byte(given))
 	if err != nil {
-		return err
+		return fmt.Errorf("hash does not match plaintext (hash: %s) (plaintext: %v...): %w",
+			k.HashedSecret, given[0:min(len(given), 4)], err)
 	}
 
 	return nil
diff --git a/docker-compose.yml b/docker-compose.yml
index 3ce07ab..82e0c89 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -45,21 +45,3 @@ services:
       - ./demo-ui:/usr/local/apache2/htdocs
     ports:
       - 80
-
-  sls:
-    build: .
-    env_file:
-      - path: ./local.env
-        required: false
-    volumes:
-      - .:/src
-    command: ["bash"]
-
-  cdk:
-    build: .
-    volumes:
-    - ./:/src
-    user: 1000:1001
-    env_file:
-    - path: local.env
-      required: false
diff --git a/openapi.yaml b/openapi.yaml
index f243409..20b0501 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -629,7 +629,7 @@ paths:
 
   /webauthn/credential/{id}:
     delete:
-      summary: Delete Credential (not currently supported in the Lambda implementation)
+      summary: Delete Credential
       responses:
         204:
           description: Success
diff --git a/router/middleware.go b/router/middleware.go
index 0469a33..f9ca988 100644
--- a/router/middleware.go
+++ b/router/middleware.go
@@ -2,7 +2,7 @@ package router
 
 import (
 	"context"
-	"fmt"
+	"log"
 	"net/http"
 	"strings"
 
@@ -21,7 +21,8 @@ func authenticationMiddleware(next http.Handler) http.Handler {
 
 		user, err := mfa.AuthenticateRequest(r)
 		if err != nil {
-			http.Error(w, fmt.Sprintf("unable to authenticate request: %s", err), http.StatusUnauthorized)
+			log.Printf("unable to authenticate request: %s", err)
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
 			return
 		}