diff --git a/oauth2/heroku.go b/oauth2/heroku.go
index 205990de2..13121cbfa 100644
--- a/oauth2/heroku.go
+++ b/oauth2/heroku.go
@@ -2,6 +2,7 @@ package oauth2
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 
 	"github.com/influxdata/chronograf"
@@ -65,6 +66,15 @@ func (h *Heroku) PrincipalID(provider *http.Client) (string, error) {
 	// Requests fail to Heroku unless this Accept header is set.
 	req.Header.Set("Accept", "application/vnd.heroku+json; version=3")
 	resp, err := provider.Do(req)
+	if resp.StatusCode/100 != 2 {
+		err := fmt.Errorf(
+			"Unable to GET user data from %s. Status: %s",
+			HerokuAccountRoute,
+			resp.Status,
+		)
+		h.Logger.Error("", err)
+		return "", err
+	}
 	if err != nil {
 		h.Logger.Error("Unable to communicate with Heroku. err:", err)
 		return "", err