How to skip Devise authentication when using an API key?

Question

I\'m using Devise on my application and would like to create a global API key that can access JSON data of anyone\'s account without having to log-in.

For example, s

Answer 1

I know its been a while since this was asked, but thought I would throw in one more option that i've used in the past

class Api::ApplicationController < ApplicationController

skip_before_filter :authenticate_user!

This assumes that you have an application controller in your API directory that all of your api controllers inherit from. If not, you can just put the skip in each controller.

Answer 2

One option no one has mentioned is to have a completely separate set of controllers for the API that do not inherit from ApplicationController.

I have seen the pattern used where API controllers live in files such as /app/controllers/api/v1/somethings.rb and are accessible via routes such as /api/v1/somethings. Each of the specific API controllers inherits from a base API controller that inherits from ActionController::Base, so does not include any of the filters defined on ApplicationController.

Answer 3

You can do this with your before_filter in your Controller.

Currently, you probably have something like:

class SomeController < ApplicationController
  before_filter :authenticate_user!
end

Instead of calling this, you can define a different method (ideally in ApplicationController)

class ApplicationController < ActionController::Base
  before_filter :authenticate_or_token

  private
  def authenticate_or_token
    if params[:api_key] == 1234
      @current_user = User.new(:admin => true, :any => "other", :required => "fields")
      return current_user
    end
    authenticate_user!
  end

I would recommend using a more robust method of authentication such as OAuth, but this should work for a simple 1-key based authentication.

Answer 4

An alternative to Gazler's would be to use an except:

class ApplicationController < ActionController::Base
  before_filter :authenticate_user!, except: :some_json_method

  def some_json_method
    render :nothing unless params[:api_key] == '1234'

    render :json
  end
end

This way you don't open your entire app to the key-holder (depending on your needs, whether you need that or not). If you need multiple methods opend to the key, you could probably also use something like:

class ApplicationController < ActionController::Base
  JSON_METHODS = [method_1, method2]
  before_filter :authenticate_user!, except: JSON_METHODS
  before_filter :authenticate_token, only: JSON_METHODS

  private
  def authenticate_token
    params[:api_key] == '1234'
  end
end