# Authentication for both web & api

**URL:** <https://discuss.rubyonrails.org/t/authentication-for-both-web-api/68149>\
**Category:** rubyonrails-talk\
**Created:** [November 22, 2013, 12:12am UTC](https://discuss.rubyonrails.org/t/authentication-for-both-web-api/68149 "2013-11-22T00:12:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [November 22, 2013, 12:12am UTC](https://discuss.rubyonrails.org/t/authentication-for-both-web-api/68149/1 "2013-11-22T00:12:57Z")

</div>

Hello,

I need to develop an application which needs to authenticate user by verifying login name/password for both web access and api. I need the same controller to cater to both web and api. I can put the before\_filter for the controller to make sure that user is logged-in and user\_id is in session. But how do I design the controller that if the request comes as a rest web service request then before filter should not check session for logged user but should authenticate with login/password passed as parameters with request and then should go ahead whichever way the request came to controller.

I would really appreciate any code samples/links to sites which explain how to do that.

Thanks.

---

<div class="post-metadata">

**Author:** ![Tamara\_Temple](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@Tamara\_Temple](https://discuss.rubyonrails.org/u/Tamara_Temple)\
**Post date:** [November 22, 2013, 8:58pm UTC](https://discuss.rubyonrails.org/t/authentication-for-both-web-api/68149/2 "2013-11-22T20:58:28Z")

</div>

So I haven’t personally implemented such a thing, but I’ve used such things. AWS API requests do this thing where you establish a connection using the two keys (access and secret) and get a token to use for the rest of your API accesses (I’m pretty sure this times out eventually). I’m sure you could work something similar to that using the user/pw?

---

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [November 22, 2013, 9:28pm UTC](https://discuss.rubyonrails.org/t/authentication-for-both-web-api/68149/3 "2013-11-22T21:28:26Z")

</div>

Basically, I want to know how to implement different authentication checks for different request paths - from browser or from api.