Handling External Logins with An API

[ingeniousgenius]

This is not really an issue but rather a question. What is the best way to handle external logins when working with a api only application?

Particularly a mobile application where the OAuth2 access_tokens are generated on the client through a different OAuth Grant flow. An example would be the FacebookLoginSDK for iOS or Android. The user signs in natively (not through a web browser) and retrieves an access_token/refresh_token pair.

Is there a way to submit this token to the server and create a user account based on this, opposed to having to redirect the user to the Rails Application, then to the provider, then back to the rails application and deep linking back to the mobile app.

This is quite a common issue but I really cannot seem to find any solutions whatsoever.

[joshbuker]

I think what you're looking for is likely JWT (JSON Web Tokens), which can carry encrypted payloads (e.g. session data). Unfortunately Sorcery doesn't support JWT yet, although it is a high priority feature.

A good place to dig around would be the sorcery facebook provider code, #70 / #167, or potentially looking at Omniauth, which has a better OAuth integration (although it doesn't provide some of the other user integration of Sorcery/Devise). Eventually the plan is to support JWT and use Omniauth for the provider integration, but I personally don't have time to work on that, and there hasn't been much community push for it either.