# Authenticating REST Webservices

**URL:** <https://www.ruby-forum.com/t/authenticating-rest-webservices/137901>\
**Category:** Rails\
**Created:** [May 17, 2008, 11:04pm UTC](https://www.ruby-forum.com/t/authenticating-rest-webservices/137901 "2008-05-17T23:04:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ADADAD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@ADADAD](https://www.ruby-forum.com/u/ADADAD)\
**Post date:** [May 17, 2008, 11:04pm UTC](https://www.ruby-forum.com/t/authenticating-rest-webservices/137901/1 "2008-05-17T23:04:30Z")

</div>

Hello ,  
I have an app that is RESTful where there is a CMS side and an API side  
using the same RESTful services, controllers, methods , etc. The issue  
is  
that the CMS requires traditional login (through restful\_authentication)  
but  
API client requests would need to use HTTP BASIC AUth or something  
similar I  
would assume.

How are people solving this challenge with authenticating users to  
their  
app via the web and via REST client differently to accomplish this? I  
was  
thinking of going the API Key route and authenticating individual  
applications but wasnt sure the best approach.

Thanks  
Adam

---

<div class="post-metadata">

**Author:** ![ADADAD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@ADADAD](https://www.ruby-forum.com/u/ADADAD)\
**Post date:** [May 18, 2008, 4:17am UTC](https://www.ruby-forum.com/t/authenticating-rest-webservices/137901/2 "2008-05-18T04:17:16Z")

</div>

The restful\_authentication plugin handles both. Obviously it cannot  
distinguish the two types of users since they both just use http  
requests but what it does is authenticate against one of three known  
sources: cookie, http basic, and session (where session stands for a  
logged in user). By default the HTTP basic authentication  
authenticates against your user table so you can give individual admin  
access as necessary.