AFAIK, you need to • authenticate (try to validate the credentials, or set :identity key as nil) • authorize (= actually checks if the :identity key exist) For example, /dashboard endpoint is available for authorized user but /status endpoint might be open for everyone.

I'm already authenticating manually via login handler , where i set the :identity key inside :session map of the request. I checked buddy source code. And like you said buddy.auth.wrap-authentication middleware is in my case only checking if :identity key is present in the session. When present it also adds another :identity key to the root of the request map and then one can just use buddy.auth/authenticated? on the request. I need to supply additional data inside config to tell the middleware how to handle unauthenticated requests.

So nothing wrong with duct. I just had some misconceptions about how buddy works.

This step does not raise any exceptions and is completely transparent to the user. The authentication process responsibility is to determine if a request is anonymous or is authenticated, nothing more.