Home/ Questions/Q 7607703
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T00:43:52+00:00

I’ve created a custom OAuth provider using oauth-plugin . I’d like to create a

  • 0

I’ve created a custom OAuth provider using oauth-plugin. I’d like to create a provider API that gives access to user data, but I’m not sure how to properly construct the API query.

I’ve noticed that several Omniauth strategies, including Twitter, Linkedin, and Vimeo, access user data from their respective APIs via access_token.get, but these calls to the API seem to be generic, rather than specific to a particular user.

Does something within the access_token.getcall identify the user to the API? If not, how is the user discerned?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    In 3-legged OAuth, the access token identifies and belongs to the user.

    I wrote a blog post for using oauth-plugin with rails to create an OAuth provider.

    If you follow my tutorial and use oauthenticate :interactive=>false to protect your API, then you will have access to the current_user method which will allow you to treat the user as if they are logged in.

    You can read the formal spec at https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-23 Section 4 is related to authentication and is fairly readable.

    • 0