Failing Usefully

Every failure needs a status code and a shape. 400 for a bad request, 401 for not authenticated, 403 for authenticated and not allowed, 404 for absent, 409 for a conflict, 422 for understood but invalid.

And one error shape, everywhere, so the frontend can handle failure in one place rather than guessing per endpoint.

Never leak internals to the client. The Stripe integration on this very site logs the real reason server-side and returns something plain to the visitor, because almost every failure there is a configuration problem and the detail would only expose the setup.

Same rule here. Log what you need to debug. Return what the person needs to act.