I want to use the same controller for browser users (form-based auth) and OAuth API users. Seems like gems like doorkeeper make controllers accept only OAuth 2.
Should I make a basic no-auth controller and two subclasses (one for OAuth, another for form-based)? Or is there a solution that allows it on one controller class?
The oauth-plugin allows this. You can specify:
This will allow both logged in users, and OAuth users to access the same controller actions.
I wrote a blog post on setting up an OAuth2 provider with oauth-plugin. You can follow it for the most part, however you probably don’t want to have an API base class, and you want to replace:
With: