diff --git a/deep_agent/aegra/middleware.py b/deep_agent/aegra/middleware.py
index 9f5f1d06..38f98bac 100644
--- a/deep_agent/aegra/middleware.py
+++ b/deep_agent/aegra/middleware.py
@@ -37,8 +37,10 @@ def __init__(self, message: str, status_code: int = 401):
 def validate_api_key(provided_key: str) -> bool:
     """Constant-time comparison of API keys to prevent timing attacks."""
     if not API_KEY:
-        logger.warning("LANGGRAPH_API_KEY not set — all keys accepted")
-        return True
+        raise AuthError(
+            "LANGGRAPH_API_KEY is not configured; API key authentication is unavailable",
+            status_code=500,
+        )
     return hmac.compare_digest(provided_key.encode(), API_KEY.encode())
 
 
diff --git a/tests/unit/aegra/test_middleware.py b/tests/unit/aegra/test_middleware.py
index 18465671..6ed128a4 100644
--- a/tests/unit/aegra/test_middleware.py
+++ b/tests/unit/aegra/test_middleware.py
@@ -24,9 +24,11 @@ def test_custom_status(self):
 
 
 class TestValidateApiKey:
-    def test_accepts_when_no_key_configured(self):
+    def test_raises_when_no_key_configured(self):
         with patch("deep_agent.aegra.middleware.API_KEY", ""):
-            assert validate_api_key("anything") is True
+            with pytest.raises(AuthError, match="not configured") as exc_info:
+                validate_api_key("anything")
+            assert exc_info.value.status_code == 500
 
     def test_accepts_correct_key(self):
         with patch("deep_agent.aegra.middleware.API_KEY", "secret123"):