If you’re new to building API’s with Rails you’ve probably wondered how to authenticate requests made to the API to ensure that they are coming from the correct source with correct permissions. Since API’s are stateless applications they do not have the ability to create sessions for users. (Read about how Rails Sessions work here) This creates some challenges when trying to handle authentication because the app isn’t able to remember a user’s session data from one request to the next.
Enter Json Web Tokens. Json Web Tokens (JWT) are a self contained authentication method designed for stateless authentication. A self contained authentication method is one that does not require any storage on the back-end to verify the authenticity of the request. All of the data necessary to authenticate the request is contained right inside the token!