Add authorization to a Ruby on Rails API

This tutorial performs access token validation using the jwt Gem. A Concern called Secured marks endpoints that require authentication through an incoming access token.

If you have not created an API in your Auth0 dashboard yet, use the interactive selector to create a new Auth0 API or select an existing API for your project.

To set up your first API through the Auth0 dashboard, review our getting started guide.

Each Auth0 API uses the API Identifier, which your application needs to validate the access token.

Permissions let you define how resources can be accessed on behalf of the user with a given access token. For example, you might choose to grant read access to the messages resource if users have the manager access level, and a write access to that resource if they have the administrator access level.

You can define allowed permissions in the Permissions view of the Auth0 Dashboard's APIs section.

Configure Permissions

Install the jwt Gem.

gem 'jwt'
bundle install

Create a class called JsonWebToken. This class decodes and verifies the incoming access token taken from the Authorization header of the request.

The JsonWebToken class retrieves the public key for your Auth0 tenant and then uses it to verify the signature of the access token.

Create a Concern called Secured which looks for the access token in the Authorization header of an incoming request.

If the token is present, the JsonWebToken.verify will use the jwt Gem to verify the token's signature and validate the token's claims.

In addition to verifying that the access token, the Concern also includes a mechanism for confirming the token has the sufficient scope to access the requested resources. To look for a particular scope in an access token, provide an array of required scopes and check if they are present in the payload of the token.

In this example we define a SCOPES array for all protected routes, specifying the required scopes for each one.

For the /private-scoped route, the scopes defined will be intersected with the scopes coming in the payload, to determine if it contains one or more items from the other array.

Create a controller to handle the public endpoint /api/public.

The /public endpoint does not require the Secured concern as it is accessible to non-authenticated requests.

Create a controller to handle the private endpoints: /api/private and /api/private-scoped.

/api/private is available for authenticated requests containing an Access Token with no additional scopes.

/api/private-scoped is available for authenticated requests containing an access token with the read:messages scope granted

The protected endpoints need to include the Secured concern. The Secured concern contains the required scopes for each endpoint.

Make a Call to Your API

To make calls to your API, you need an Access Token. You can get an Access Token for testing purposes from the Test view in your API settings.

Obtain a JWT

Provide the Access Token as an Authorization header in your requests.


curl --request GET \
  --url http://your-domain.com/api_path \
  --header 'authorization: Bearer YOUR_ACCESS_TOKEN_HERE'
var client = new RestClient("http://your-domain.com/api_path");
var request = new RestRequest(Method.GET);
request.AddHeader("authorization", "Bearer YOUR_ACCESS_TOKEN_HERE");
IRestResponse response = client.Execute(request);
package main

import (
	"fmt"
	"net/http"
	"io/ioutil"
)

func main() {

	url := "http://your-domain.com/api_path"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("authorization", "Bearer YOUR_ACCESS_TOKEN_HERE")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := ioutil.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.get("http://your-domain.com/api_path")
  .header("authorization", "Bearer YOUR_ACCESS_TOKEN_HERE")
  .asString();
var axios = require("axios").default;

var options = {
  method: 'GET',
  url: 'http://your-domain.com/api_path',
  headers: {authorization: 'Bearer YOUR_ACCESS_TOKEN_HERE'}
};

axios.request(options).then(function (response) {
  console.log(response.data);
}).catch(function (error) {
  console.error(error);
});
#import <Foundation/Foundation.h>

NSDictionary *headers = @{ @"authorization": @"Bearer YOUR_ACCESS_TOKEN_HERE" };

NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"http://your-domain.com/api_path"]
                                                       cachePolicy:NSURLRequestUseProtocolCachePolicy
                                                   timeoutInterval:10.0];
[request setHTTPMethod:@"GET"];
[request setAllHTTPHeaderFields:headers];

NSURLSession *session = [NSURLSession sharedSession];
NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request
                                            completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
                                                if (error) {
                                                    NSLog(@"%@", error);
                                                } else {
                                                    NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;
                                                    NSLog(@"%@", httpResponse);
                                                }
                                            }];
[dataTask resume];
$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "http://your-domain.com/api_path",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "authorization: Bearer YOUR_ACCESS_TOKEN_HERE"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
import http.client

conn = http.client.HTTPConnection("your-domain.com")

headers = { 'authorization': "Bearer YOUR_ACCESS_TOKEN_HERE" }

conn.request("GET", "/api_path", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))
require 'uri'
require 'net/http'

url = URI("http://your-domain.com/api_path")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Get.new(url)
request["authorization"] = 'Bearer YOUR_ACCESS_TOKEN_HERE'

response = http.request(request)
puts response.read_body
import Foundation

let headers = ["authorization": "Bearer YOUR_ACCESS_TOKEN_HERE"]

let request = NSMutableURLRequest(url: NSURL(string: "http://your-domain.com/api_path")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
Checkpoint

Now that you have configured your application, run your application to verify that:

  • GET /api/public is available for non-authenticated requests.
  • GET /api/private is available for authenticated requests.
  • GET /api/private-scoped is available for authenticated requests containing an Access Token with the read:messages scope.

Next Steps

Excellent work! If you made it this far, you should now have login, logout, and user profile information running in your application.

This concludes our quickstart tutorial, but there is so much more to explore. To learn more about what you can do with Auth0, check out:

Did it work?

Any suggestion or typo?

Edit on GitHub
Sign Up

Sign up for an or to your existing account to integrate directly with your own tenant.