title: Rails api and native mobile app authentication
body: <p>I know there is a lot of information about this topic, but I can't find any that is up to date.
  I see topics like <a href="http://arvind-ror.blogspot.fr/2013/06/ruby-on-rails-and-android-authentication.html" rel="noreferrer">this one relating to rails and android authentication</a> but I see that  <a href="https://github.com/plataformatec/devise/issues/2739" rel="noreferrer"><code>TokenAuthenticatable</code> is now removed from devise</a>.</p>
  
  <p>My question is simple: is there a good way to authenticate users from native Android and iPhone apps using Rails 4? Does anyone know of good tutorials or articles that provide a solution ?</p>
  
  <p><strong>Adam Waite Adding a bounty:</strong></p>
  
  <p>I have just opened a 500 bounty on this question because I can't find the correct practice for authenticating a user from an iOS app to a Rails API anywhere. This is what I was considering doing but have no idea if it's secure or not?!:</p>
  
  <p>Let's assume we have a <code>User</code> record. A user has signed up for an account which has created a <code>User</code> record in the database with an <code>email</code> column and a <code>password_digest</code> column.</p>
  
  <p>When the user signs-in I would like that user to remain authenticated on the mobile app until explicitly signing-out.</p>
  
  <p>I imagine we're going to need a token based authentication. I would perhaps create an ApiKey record when the <code>User</code> is created and have that saved as an association on the <code>User</code> record.</p>
  
  <p>When the user signs in/up, the response will contain an API token (something like <code>SecureRandom.hex</code>) which will be saved in the iOS Keychain and used with all subsequent requests to verify the user by passing it in a header and verifying it using something like:</p>
  
  <pre><code>before_filter :restrict_access
  
  private
  
  def restrict_access
  authenticate_or_request_with_http_token do |token, options|
    ApiKey.exists?(access_token: token)
  end
  </code></pre>
  
  <p>Is this secure? Should I be refreshing the token with every request and including it in the response?</p>
  
  <p>What other options do I have? What do the likes of Facebook, Twitter and Pinterest do?</p>
  
  <p>I am aware of OAuth2.0, but is that not for granting external applications?</p>
  
  <p>Is there a gem that manages any of this?</p>
  
  <p>Sorry, completely unsure here. </p>
  
  <p>500 to the best answer.</p>