API Access with Devise Authentication - Best Practices?

Question

I'm using Devise in a Rails app and want to expose some of the model data via an API, but access to the API should be restricted just like the app.

$ curl http://myapp.com/api/v1/sales/7.json
{"error":"You need to sign in or sign up before continuing."}

Obviously.

Is there a best practice for accessing the API in situations like this? I'd prefer to authenticate + grab the data in one step, but that's just to make the client's job easier. They'll be pulling in the data client-side with JQuery.

Thanks for any info!

• Vanessa

Answer 1

I recommend you follow the Option 2: Using API Key section on the following post to implement API authentication in Rails.

• http://www.whatcodecraves.com/articles/2008/11/25/how_to_make_an_api_for_a_rails_app/

It's lightweight and simply requires passing an api_key param with each request.