diff --git a/internal/keycloak/client.go b/internal/keycloak/client.go
index 40125b82..f906064f 100644
--- a/internal/keycloak/client.go
+++ b/internal/keycloak/client.go
@@ -129,8 +129,7 @@ func (c *Client) UserRolesAndGroups(ctx context.Context,
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("couldn't get user token: %v", err)
 	}
-	c.log.Debug("got user token", zap.String("access token",
-		userToken.AccessToken))
+	c.log.Debug("got user token")
 	// parse and extract verified attributes
 	tok, err := jwt.ParseSigned(userToken.AccessToken)
 	if err != nil {