title: How to skip Devise authentication when using an API key?
body: <p>I'm using Devise on my application and would like to create a global API key that can access JSON data of anyone's account without having to log-in.</p>
  
  <p>For example, say my API Key is <code>1234</code> and I have two users who have created two different restaurants.</p>
  
  <ul>
  <li>User 1 - Restaurant 1 (/restaurants/1)</li>
  <li>User 2 - Restaurant 2 (/restaurants/2)</li>
  </ul>
  
  <p>And I open a brand new browser and haven't logged into anything and I pass into my URL <code>.../restaurants/2.json?api_key=1234</code>, I should be able to access the JSON data of that restaurant without having to log-in as <em>User 2</em></p>
  
  <p>Whats the best way to do this?</p>
  
  <p>I've followed the <a href="http://railscasts.com/episodes/352-securing-an-api" rel="noreferrer">Railscast #352 Securing an API</a> so I'm able to access JSON stuff by passing in the API key but I have to log-in to see anything.</p>
  
  <h3>Edit 1: Using CanCan</h3>
  
  <p>I should mention that I'm also using CanCan for roles but not sure if that'll play any role (pun not intended) in this situation.</p>
  
  <h3>Edit 2: Implimenting with API Versioning</h3>
  
  <p>I followed the Railscast #350 and #352 which teach you how to create REST API Versioning and how to secure it with an API Key.</p>
  
  <p>Here's what my controllers/api/v1/restaurants/restaurants_controller.rb looks like:</p>
  
  <pre><code>module Api
    module V1
      class RestaurantsController &lt; ApplicationController
        before_filter :restrict_access
  
        respond_to :json
  
        def index
          respond_with Restaurant.all
        end
  
        def show
          respond_with Restaurant.find(params[:id])
        end
  
      private
  
        def restrict_access
          api_key = ApiKey.find_by_access_token(params[:api_key])
          head :unauthorized unless api_key        
        end
      end
    end
  end
  </code></pre>
  
  <p>And my <code>application_controller.rb</code> still has the <code>before_filter :authenticate_user!</code> code in it.</p>
  
  <h1>Solution</h1>
  
  <p>I first followed the <a href="http://railscasts.com/episodes/350-rest-api-versioning" rel="noreferrer">Railscast #350 on REST API Versioning</a> and moved all my JSON API calls to <code>/apps/api/v1/...</code></p>
  
  <p>Then, following Steve Jorgensen's solution below, made sure my API module inherited from <code>ActionController::Base</code> instead of <code>ApplicationController</code> so that it bypassed Devise's <code>before_filter :authenticate_user!</code> code within the <code>ApplicationController</code>.</p>
  
  <p>So, my Edit 2 code when from looking like this:</p>
  
  <pre><code>module Api
    module V1
      class RestaurantsController &lt; ApplicationController
      ...
  </code></pre>
  
  <p>to</p>
  
  <pre><code>module Api
    module V1
      #Replace 'ApplicationController' with 'ActionController::Base'
      class RestaurantsController &lt; ActionController::Base
      ...
  </code></pre>