diff --git a/meilisearch-http/src/error.rs b/meilisearch-http/src/error.rs
index 6124ed880..4f47abd66 100644
--- a/meilisearch-http/src/error.rs
+++ b/meilisearch-http/src/error.rs
@@ -10,23 +10,6 @@ use meilisearch_error::{Code, ErrorCode};
 use milli::UserError;
 use serde::{Deserialize, Serialize};
 
-#[derive(Debug, thiserror::Error)]
-pub enum AuthenticationError {
-    #[error("You must have an authorization token")]
-    MissingAuthorizationHeader,
-    #[error("Invalid API key")]
-    InvalidToken(String),
-}
-
-impl ErrorCode for AuthenticationError {
-    fn error_code(&self) -> Code {
-        match self {
-            AuthenticationError::MissingAuthorizationHeader => Code::MissingAuthorizationHeader,
-            AuthenticationError::InvalidToken(_) => Code::InvalidToken,
-        }
-    }
-}
-
 #[derive(Debug, Serialize, Deserialize, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct ResponseError {
diff --git a/meilisearch-http/src/extractors/authentication/error.rs b/meilisearch-http/src/extractors/authentication/error.rs
new file mode 100644
index 000000000..29578e373
--- /dev/null
+++ b/meilisearch-http/src/extractors/authentication/error.rs
@@ -0,0 +1,26 @@
+use meilisearch_error::{Code, ErrorCode};
+
+#[derive(Debug, thiserror::Error)]
+pub enum AuthenticationError {
+    #[error("You must have an authorization token")]
+    MissingAuthorizationHeader,
+    #[error("Invalid API key")]
+    InvalidToken(String),
+    // Triggered on configuration error.
+    #[error("Irretrievable state")]
+    IrretrievableState,
+    #[error("Unknown authentication policy")]
+    UnknownPolicy,
+}
+
+impl ErrorCode for AuthenticationError {
+    fn error_code(&self) -> Code {
+        match self {
+            AuthenticationError::MissingAuthorizationHeader => Code::MissingAuthorizationHeader,
+            AuthenticationError::InvalidToken(_) => Code::InvalidToken,
+            AuthenticationError::IrretrievableState => Code::Internal,
+            AuthenticationError::UnknownPolicy => Code::Internal,
+        }
+    }
+}
+
diff --git a/meilisearch-http/src/extractors/authentication/mod.rs b/meilisearch-http/src/extractors/authentication/mod.rs
index fd3272e2f..6b9ac24ae 100644
--- a/meilisearch-http/src/extractors/authentication/mod.rs
+++ b/meilisearch-http/src/extractors/authentication/mod.rs
@@ -1,3 +1,5 @@
+mod error;
+
 use std::any::{Any, TypeId};
 use std::collections::HashMap;
 use std::marker::PhantomData;
@@ -7,7 +9,8 @@ use actix_web::FromRequest;
 use futures::future::err;
 use futures::future::{ok, Ready};
 
-use crate::error::{AuthenticationError, ResponseError};
+use crate::error::ResponseError;
+use error::AuthenticationError;
 
 macro_rules! create_policies {
     ($($name:ident), *) => {
@@ -151,7 +154,7 @@ impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D>
                         data,
                         _marker: PhantomData,
                     }),
-                    None => todo!("Data not configured"),
+                    None => err(AuthenticationError::IrretrievableState.into()),
                 },
                 AuthConfig::Auth(policies) => match policies.get::<P>() {
                     Some(policy) => match req.headers().get("x-meili-api-key") {
@@ -162,7 +165,7 @@ impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D>
                                         data,
                                         _marker: PhantomData,
                                     }),
-                                    None => todo!("Data not configured"),
+                                    None => err(AuthenticationError::IrretrievableState.into()),
                                 }
                             } else {
                                 err(AuthenticationError::InvalidToken(String::from("hello")).into())
@@ -170,10 +173,10 @@ impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D>
                         }
                         None => err(AuthenticationError::MissingAuthorizationHeader.into()),
                     },
-                    None => todo!("no policy found"),
+                    None => err(AuthenticationError::UnknownPolicy.into()),
                 },
             },
-            None => todo!(),
+            None => err(AuthenticationError::IrretrievableState.into()),
         }
     }
 }