diff --git a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
index 724880638..743c5b321 100644
--- a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
@@ -307,8 +307,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           if (
             data.tokenReviewMode &&
             data.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway &&
-            !data.gatewayId &&
-            data.tokenReviewMode !== undefined
+            !data.gatewayId
           ) {
             ctx.addIssue({
               path: ["gatewayId"],
@@ -316,7 +315,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
               message: "When token review mode is set to Gateway, a gateway must be selected"
             });
           }
-          if (data.accessTokenMaxTTL && data.accessTokenTTL ? data.accessTokenTTL <= data.accessTokenMaxTTL : true) {
+          if (data.accessTokenMaxTTL && data.accessTokenTTL ? data.accessTokenTTL > data.accessTokenMaxTTL : false) {
             ctx.addIssue({
               path: ["accessTokenTTL"],
               code: z.ZodIssueCode.custom,
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
index 59c062686..4eb45ba14 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
@@ -249,7 +249,11 @@ export const identityKubernetesAuthServiceFactory = ({
         .catch((err) => {
           if (err instanceof AxiosError) {
             if (err.response) {
-              const { message } = err?.response?.data as unknown as { message?: string };
+              let { message } = err?.response?.data as unknown as { message?: string };
+
+              if (!message && typeof err.response.data === "string") {
+                message = err.response.data;
+              }
 
               if (message) {
                 throw new UnauthorizedError({
diff --git a/cli/packages/util/helper.go b/cli/packages/util/helper.go
index ceb0792f1..fc3f994a7 100644
--- a/cli/packages/util/helper.go
+++ b/cli/packages/util/helper.go
@@ -299,7 +299,7 @@ func GetCmdFlagOrEnv(cmd *cobra.Command, flag string, envNames []string) (string
 	}
 	if value == "" {
 		for _, env := range envNames {
-			value = os.Getenv(env)
+			value = strings.TrimSpace(os.Getenv(env))
 			if value != "" {
 				break
 			}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx
index 1b55bc60e..e43c94a7e 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx
@@ -322,7 +322,6 @@ export const IdentityKubernetesAuthForm = ({
                               isDisabled={!isAllowed}
                               value={value as string}
                               onValueChange={(v) => {
-                                console.log("v", v);
                                 if (v !== "") {
                                   onChange(v);
                                 }