To be able to authenticate a user using JSON using Devise you need to bypass the CSRF token warning that Rails throws when signing in with JSON, this is useful when trying to use a mobile app that will consume your app api and authenticate. The documention to solve this problem is outdated on google or stack overflow. Rails 5 did some changes, this is how to do it.
protect_from_forgery unless: -> { request.format.json? }