I use the fallback controller.. and then just let the controller return {:error, :unauthorized } when needed - so the controller is nice and DRY

defmodule Myapp.Web.SomeController do
  ...
  action_fallback(Myapp.Web.FallbackController)


  def show(conn, params) do
   user = SomeAuth.get_user(params)
   if user do
     render normal etc..
   else
     {:error, :unauthorized }
   end 
  end
end

and fallback has:

defmodule Myapp.Web.FallbackController do
  @moduledoc """
  Translates controller action results into valid `Plug.Conn` responses.

  See `Phoenix.Controller.action_fallback/1` for more details.
  """
  use Myapp.Web, :controller

...

  def call(conn, {:error, :unauthorized}) do
    conn
    |> put_status(:unauthorized)
    |> render(Myapp.Web.ErrorView, "auth_required.json")
  end
end

and the ErrorView has a

  def render("auth_required.json", _assigns) do
    %{error: "Unauthorized"}
  end