# API + tokens?

**URL:** <https://www.ruby-forum.com/t/api-tokens/195645>\
**Category:** Rails\
**Created:** [September 27, 2010, 3:21pm UTC](https://www.ruby-forum.com/t/api-tokens/195645 "2010-09-27T15:21:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbce88/32.png) [@paulo](https://www.ruby-forum.com/u/paulo)\
**Post date:** [September 27, 2010, 3:21pm UTC](https://www.ruby-forum.com/t/api-tokens/195645/1 "2010-09-27T15:21:27Z")

</div>

Hi all,

This is almost certainly a noob question, but I’ve hit a wall  
developing my rails3 app.

I am looking to integrate various sections with a legacy system based  
on PHP. I had envisaged this being fairly straight forward, using curl  
to send POST requests for example. The issue / dilema I have is that  
all requests are met with an InvalidAuthenticityToken error. I don’t  
want to lose this security feature, but am not sure how to proceed in  
terms of providing a secure API for the integration.

Is it possible to send a set token along with all requests, or am I  
missing something here?

Any pointers would be much appreciated!

Cheers,

Paul T.

---

<div class="post-metadata">

**Author:** ![paulo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbce88/32.png) [@paulo](https://www.ruby-forum.com/u/paulo)\
**Post date:** [September 27, 2010, 3:25pm UTC](https://www.ruby-forum.com/t/api-tokens/195645/2 "2010-09-27T15:25:33Z")

</div>

Which direction are you curling in? From PHP to Rails, or vice-versa?

Walter

---

<div class="post-metadata">

**Author:** ![paulo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbce88/32.png) [@paulo](https://www.ruby-forum.com/u/paulo)\
**Post date:** [September 27, 2010, 4:25pm UTC](https://www.ruby-forum.com/t/api-tokens/195645/3 "2010-09-27T16:25:52Z")

</div>

From PHP to rails currently, I will need to work in both directions  
however going forward but could possibly just use MySQL queries from  
Rails to the PHP app if required

Thanks,

Paul

---

<div class="post-metadata">

**Author:** ![paulo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbce88/32.png) [@paulo](https://www.ruby-forum.com/u/paulo)\
**Post date:** [September 27, 2010, 4:45pm UTC](https://www.ruby-forum.com/t/api-tokens/195645/4 "2010-09-27T16:45:07Z")

</div>

paulo wrote:

> Hi all,
> 
> This is almost certainly a noob question, but I’ve hit a wall  
> developing my rails3 app.
> 
> I am looking to integrate various sections with a legacy system based  
> on PHP. I had envisaged this being fairly straight forward, using curl  
> to send POST requests for example. The issue / dilema I have is that  
> all requests are met with an InvalidAuthenticityToken error. I don’t  
> want to lose this security feature, but am not sure how to proceed in  
> terms of providing a secure API for the integration.

For API calls, you probably don’t want the authenticity token. That’s  
only for Rails-generated forms, as a measure of protection against  
spoofed requests. It’s meaningless for APIs. If you want a secure API,  
you’ll better off using OAuth or HTTP-Basic authentication, not the  
Rails authenticity token.

A quick Google search turned up

> **[Patrick Tulskie](https://patricktulskie.com)**
>
> Patrick Tulskie dot com

for turning off the token check sometimes.

> Is it possible to send a set token along with all requests,

I don’t believe so.

> or am I  
> missing something here?
> 
> Any pointers would be much appreciated!
> 
> Cheers,
> 
> Paul T.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![paulo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbce88/32.png) [@paulo](https://www.ruby-forum.com/u/paulo)\
**Post date:** [September 27, 2010, 5:38pm UTC](https://www.ruby-forum.com/t/api-tokens/195645/5 "2010-09-27T17:38:29Z")

</div>

Right, will start looking in that direction then, thanks for that  
Marnen

Paul