# How can I implement authentication in my API?

**URL:** <https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488>\
**Category:** Rails\
**Created:** [June 18, 2009, 4:10am UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488 "2009-06-18T04:10:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [June 18, 2009, 4:10am UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/1 "2009-06-18T04:10:49Z")

</div>

I’m developing an API for my site, and I’m wondering how I can make it  
so requests require basic access authentication (like in Twitter’s API  
for example)? I’m using restful-authentication on Rails 2.3.2. Thanks!

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [June 18, 2009, 5:48am UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/2 "2009-06-18T05:48:59Z")

</div>

Andrew wrote:

> I’m developing an API for my site, and I’m wondering how I can make it  
> so requests require basic access authentication (like in Twitter’s API  
> for example)?  
> […]

I’m no expert on this, but perhaps you want to use OAuth like Twitter  
has done.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [June 18, 2009, 7:06pm UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/3 "2009-06-18T19:06:51Z")

</div>

There’s already support for basic auth in restful-authentication; it  
only gets used by default for (off the top of my head) JSON and XML  
formatted requests. The support is pretty simple - take a look at (in  
restful\_auth) AuthenticatedSystem#access\_denied, and also the core  
docs for ActionController::HttpAuthentication.

–Matt J.

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [June 19, 2009, 5:20am UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/4 "2009-06-19T05:20:35Z")

</div>

Thanks Matt, that’s exactly what I was looking for.

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [July 16, 2009, 5:18pm UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/5 "2009-07-16T17:18:38Z")

</div>

Can you post your code how you fixed it please!  
I am using also restful authentication and want to provide basic  
authenticaton for xml!

Thank you

Wouter

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [July 16, 2009, 8:37pm UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/6 "2009-07-16T20:37:18Z")

</div>

def authenticate  
@current\_user = authenticate\_or\_request\_with\_http\_basic { |u, p|  
User.authenticate(u, p) }  
end

Use as a before filter.

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [July 17, 2009, 11:21pm UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/7 "2009-07-17T23:21:02Z")

</div>

But with this code i have to authenticate every time when i try to  
access the website…

I have this code for authenticate:

def authenticate  
case request.format  
when Mime::XML, Mime::ATOM  
if self.user = authenticate\_or\_request\_with\_http\_basic { |u,  
p| User.authenticate(u, p) }  
@current\_user = user  
else  
request\_http\_basic\_authentication  
end  
else  
user = User.find\_by\_remember\_token(cookies[:auth\_token])  
end  
end

But when i try to access an xml resource i get the authentication  
dialog and i get a page with error (ouldn’t find Profile without an  
ID)  
and when i refresh i get the right xml page… How can i fix this… My  
authentication doesnt work because of this on android!

Thank you

---

<div class="post-metadata">

**Author:** ![andrew](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f19dbf/32.png) [@andrew](https://www.ruby-forum.com/u/andrew)\
**Post date:** [July 22, 2009, 11:10am UTC](https://www.ruby-forum.com/t/how-can-i-implement-authentication-in-my-api/170488/8 "2009-07-22T11:10:48Z")

</div>

But with this code i have to authenticate every time when i try to  
access the website…

I have this code for authenticate:

def authenticate  
case request.format  
when Mime::XML, Mime::ATOM  
if self.user = authenticate\_or\_request\_with\_http\_basic { |u,  
p| User.authenticate(u, p) }  
@current\_user = user  
else  
request\_http\_basic\_authentication  
end  
else  
user = User.find\_by\_remember\_token(cookies[:auth\_token])  
end  
end

But when i try to access an xml resource i get the authentication  
dialog and i get a page with error (ouldn’t find Profile without an  
ID)  
and when i refresh i get the right xml page… How can i fix this… My  
authentication doesnt work because of this on android!

Thank you