diff --git a/apps/edr-passenger-web/portal/src/app/booking/auth-check/page.tsx b/apps/edr-passenger-web/portal/src/app/booking/auth-check/page.tsx
index d9c7f92a3..e38c07d90 100644
--- a/apps/edr-passenger-web/portal/src/app/booking/auth-check/page.tsx
+++ b/apps/edr-passenger-web/portal/src/app/booking/auth-check/page.tsx
@@ -4,7 +4,8 @@ import { useEffect, useState } from 'react';
 import { useRouter } from 'next/navigation';
 import { useAuthStore } from '@/lib/auth-store';
 import { useBookingStore } from '@/lib/booking-store';
-import { UserPlus, LogIn, ChevronLeft } from 'lucide-react';
+import { UserPlus, ChevronLeft } from 'lucide-react';
+// import { LogIn } from 'lucide-react'; // TODO: re-enable auth — used by commented-out SignIn/Register button
 
 function Tooltip({ children, content }: { children: React.ReactNode; content: string[] }) {
   const [visible, setVisible] = useState(false);
@@ -95,6 +96,7 @@ export default function AuthCheckPage() {
             </button>
           </Tooltip>
 
+          {/* TODO: re-enable auth — SignIn or Register button commented out until auth integration
           <Tooltip content={[
             'Saved passenger details',
             'View booking history',
@@ -108,6 +110,7 @@ export default function AuthCheckPage() {
               SignIn or Register
             </button>
           </Tooltip>
+          */}
         </div>
 
         <div className="mt-8 text-center">
diff --git a/apps/edr-passenger-web/portal/src/components/AppSidebar.tsx b/apps/edr-passenger-web/portal/src/components/AppSidebar.tsx
index 0acb5d9ea..08874193a 100644
--- a/apps/edr-passenger-web/portal/src/components/AppSidebar.tsx
+++ b/apps/edr-passenger-web/portal/src/components/AppSidebar.tsx
@@ -192,20 +192,22 @@ export default function AppSidebar() {
             )}
           </div>
         ) : (
-          <div className="flex items-center gap-2 px-1 pt-1">
-            <Link
-              href="/login"
-              className="flex-1 text-center px-3 py-2 text-sm font-medium text-gray-100 hover:bg-white/10 rounded-lg transition-colors"
-            >
-              Sign in
-            </Link>
-            <Link
-              href="/register"
-              className="flex-1 text-center px-3 py-2 text-sm font-medium bg-white text-[rgb(20_113_76)] hover:bg-gray-100 rounded-lg transition-colors"
-            >
-              Register
-            </Link>
-          </div>
+          // TODO: re-enable auth — Sign in / Register links commented out until auth integration
+          // <div className="flex items-center gap-2 px-1 pt-1">
+          //   <Link
+          //     href="/login"
+          //     className="flex-1 text-center px-3 py-2 text-sm font-medium text-gray-100 hover:bg-white/10 rounded-lg transition-colors"
+          //   >
+          //     Sign in
+          //   </Link>
+          //   <Link
+          //     href="/register"
+          //     className="flex-1 text-center px-3 py-2 text-sm font-medium bg-white text-[rgb(20_113_76)] hover:bg-gray-100 rounded-lg transition-colors"
+          //   >
+          //     Register
+          //   </Link>
+          // </div>
+          null
         )}
       </div>
 
diff --git a/apps/edr-passenger-web/portal/src/components/BottomTabBar.tsx b/apps/edr-passenger-web/portal/src/components/BottomTabBar.tsx
index ee4cdccad..8017f3087 100644
--- a/apps/edr-passenger-web/portal/src/components/BottomTabBar.tsx
+++ b/apps/edr-passenger-web/portal/src/components/BottomTabBar.tsx
@@ -1,9 +1,10 @@
 'use client';
 
-import { Home, Phone, Ticket, User } from 'lucide-react';
+import { Home, Phone, Ticket } from 'lucide-react';
+// import { User } from 'lucide-react'; // TODO: re-enable auth — used by commented-out Sign in tab
 import Link from 'next/link';
 import { usePathname } from 'next/navigation';
-import { useAuthStore } from '@/lib/auth-store';
+// import { useAuthStore } from '@/lib/auth-store'; // TODO: re-enable auth
 
 // The linear, one-screen-at-a-time booking flow — each of these pages already
 // has its own sticky mobile CTA bar (and the mobile step strip at the top),
@@ -21,7 +22,7 @@ const LINEAR_FLOW_PREFIXES = [
 
 export default function BottomTabBar() {
   const pathname = usePathname() ?? '';
-  const isAuthenticated = useAuthStore((s) => s.isAuthenticated);
+  // const isAuthenticated = useAuthStore((s) => s.isAuthenticated); // TODO: re-enable auth
 
   const isInLinearFlow = LINEAR_FLOW_PREFIXES.some((p) => pathname.startsWith(p));
   if (isInLinearFlow) return null;
@@ -30,12 +31,13 @@ export default function BottomTabBar() {
     { href: '/', label: 'Home', icon: Home, match: (p: string) => p === '/' },
     { href: '/booking/lookup', label: 'Bookings', icon: Ticket, match: (p: string) => p.startsWith('/booking/lookup') || p.startsWith('/booking/detail') },
     { href: '/contact', label: 'Contact', icon: Phone, match: (p: string) => p.startsWith('/contact') },
-    {
-      href: isAuthenticated ? '/profile' : '/login',
-      label: isAuthenticated ? 'Account' : 'Sign in',
-      icon: User,
-      match: (p: string) => p.startsWith('/profile') || p.startsWith('/login') || p.startsWith('/register'),
-    },
+    // TODO: re-enable auth — auth login/register tab commented out until auth integration
+    // {
+    //   href: isAuthenticated ? '/profile' : '/login',
+    //   label: isAuthenticated ? 'Account' : 'Sign in',
+    //   icon: User,
+    //   match: (p: string) => p.startsWith('/profile') || p.startsWith('/login') || p.startsWith('/register'),
+    // },
   ];
 
   return (
diff --git a/apps/edr-payment-api/src/modules/webhooks/handlers/waafi-webhook.service.ts b/apps/edr-payment-api/src/modules/webhooks/handlers/waafi-webhook.service.ts
index 232957f79..3cd0b4c1c 100644
--- a/apps/edr-payment-api/src/modules/webhooks/handlers/waafi-webhook.service.ts
+++ b/apps/edr-payment-api/src/modules/webhooks/handlers/waafi-webhook.service.ts
@@ -45,6 +45,12 @@ export class WaafiWebhookService {
 
     const mapped = this.provider.mapWebhookStatus(payment.status);
 
+    this.logger.log(
+      `Waafi authorization: ref=${payment.reference_id} txn=${payment.transaction_id} ` +
+        `rawStatus=${payment.status} mapped=${mapped} ` +
+        `signatureValid=${signatureValid} (fresh=${this.isFresh(timestamp)}) eventId=${eventId ?? "n/a"}`,
+    );
+
     await this.processor.process({
       provider: this.provider.method,
       // X-Webhook-Event-Id is unique per event; fall back to a derived id if absent.
diff --git a/apps/edr-payment-api/src/modules/webhooks/webhooks.controller.ts b/apps/edr-payment-api/src/modules/webhooks/webhooks.controller.ts
index f1e4fa6b0..6c923e8b4 100644
--- a/apps/edr-payment-api/src/modules/webhooks/webhooks.controller.ts
+++ b/apps/edr-payment-api/src/modules/webhooks/webhooks.controller.ts
@@ -127,10 +127,14 @@ export class WebhooksController {
     @Req() req: { rawBody?: Buffer },
   ) {
 
-    this.logger.log("\n\n\n\nWaafi payment notification callback (Djibouti)\n\n\n\n");
     this.logger.log(
       `Waafi webhook hit: event=${payload?.event ?? "unknown"} eventId=${headers["x-webhook-event-id"] ?? "n/a"}`,
     );
+    this.logger.log(`Waafi webhook headers: ${JSON.stringify(headers)}`);
+    this.logger.log(`Waafi webhook payload: ${JSON.stringify(payload)}`);
+    this.logger.log(
+      `Waafi webhook raw body: ${req.rawBody?.toString("utf8") ?? "(none)"}`,
+    );
     try {
       // HMAC verification must sign over the exact raw bytes Waafi sent, not re-serialized JSON.
       const rawBody = req.rawBody?.toString("utf8") ?? "";