From 9e9e917f2ca117201a7b79a43be7aff995c990f1 Mon Sep 17 00:00:00 2001
From: Abdullah Alqahtani <61029571+anqorithm@users.noreply.github.com>
Date: Mon, 2 Nov 2026 22:54:02 +0100
Subject: [PATCH] docs(middleware): correct KeyAuth error handling contract

---
 middleware/key_auth.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/middleware/key_auth.go b/middleware/key_auth.go
index 2dcb98039..555eae2ad 100644
--- a/middleware/key_auth.go
+++ b/middleware/key_auth.go
@@ -49,7 +49,7 @@ type KeyAuthConfig struct {
 	// function. ErrorHandler is executed with last missing (ErrExtractionValueMissing) or an invalid key.
 	// It may be used to define a custom error.
 	//
-	// Note: when error handler swallows the error (returns nil) middleware continues handler chain execution towards handler.
+	// Note: when ErrorHandler returns nil, the handler chain continues only if ContinueOnIgnoredError is true.
 	// This is useful in cases when portion of your site/api is publicly accessible and has extra features for authorized users
 	// In that case you can use ErrorHandler to set default public auth value to request and continue with handler chain.
 	ErrorHandler KeyAuthErrorHandler
@@ -118,7 +118,7 @@ var DefaultKeyAuthConfig = KeyAuthConfig{
 //
 // For valid key it calls the next handler.
 // For invalid key, it sends "401 - Unauthorized" response.
-// For missing key, it sends "400 - Bad Request" response.
+// For missing key, it sends "401 - Unauthorized" response.
 func KeyAuth(fn KeyAuthValidator) echo.MiddlewareFunc {
 	c := DefaultKeyAuthConfig
 	c.Validator = fn
@@ -129,7 +129,7 @@ func KeyAuth(fn KeyAuthValidator) echo.MiddlewareFunc {
 //
 // For first valid key it calls the next handler.
 // For invalid key, it sends "401 - Unauthorized" response.
-// For missing key, it sends "400 - Bad Request" response.
+// For missing key, it sends "401 - Unauthorized" response.
 func KeyAuthWithConfig(config KeyAuthConfig) echo.MiddlewareFunc {
 	return toMiddlewareOrPanic(config)
 }