diff --git a/services/mam-api/src/middleware/auth.js b/services/mam-api/src/middleware/auth.js
index 17cf85a..4711ddd 100644
--- a/services/mam-api/src/middleware/auth.js
+++ b/services/mam-api/src/middleware/auth.js
@@ -1,4 +1,16 @@
+/**
+ * Authentication middleware.
+ *
+ * When AUTH_ENABLED=true in the environment, every protected route requires
+ * an active session (set by POST /api/v1/auth/login).
+ *
+ * When AUTH_ENABLED is unset or any other value, the middleware is a no-op
+ * so the stack can be deployed and tested without setting up users first.
+ * Set AUTH_ENABLED=true in production after running POST /api/v1/auth/setup
+ * to create the first admin account.
+ */
 export const requireAuth = (req, res, next) => {
+  if (process.env.AUTH_ENABLED !== 'true') return next();
   if (!req.session || !req.session.userId) {
     return res.status(401).json({ error: 'Unauthorized' });
   }