# Building Secure APIs with Rails 6 and Auth0 **URL:** \ **Category:** Blog Discussions\ **Tags:** rails-api, auth0\ **Created:** [June 15, 2020, 12:31pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674 "2020-06-15T12:31:39Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [June 15, 2020, 12:31pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/1 "2020-06-15T12:31:40Z")
Learn how to easily integrate Auth0 with Rails 6 to build secure APIs. [Learn more](https://auth0.com/blog/building-secure-apis-with-rails-6-and-auth0/) Brought for you by **John Brennan** ![Building Secure APIs with Rails 6 and Auth0](https://global.discourse-cdn.com/auth0/original/3X/d/c/dc92d36aee247b0c312291b2600449e223bfa9d7.png) ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [June 15, 2020, 12:46pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/2 "2020-06-15T12:46:50Z")
Let’s join the discussion and let us know your thoughts Ruby developers! ---
**Author:** ![itinsley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/itinsley/32/24849_2.png) [@itinsley](https://community.auth0.com/u/itinsley)\ **Post date:** [October 12, 2020, 11:17am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/3 "2020-10-12T11:17:54Z")
## EDIT - FIXED You need to add audience to your auth\_config.json then specify the audience in createAuth0Client. Your audience is the “Api Identifier”, handily labelled as “API Audience” on the dashboard list of API’s ```auto auth0 = await createAuth0Client({ domain: config.domain, client_id: config.clientId, audience: config.audience }); ``` Then use the same options (or at the very least specify the audience again, when calling getTokenSilently) `const accessToken = await auth0.getTokenSilently(auth0.options);` This will return an accessToken that is a JWT ## ORIGINAL POST BELOW For my client integration I am using the [auth0-spa-js tutorial](https://auth0.com/docs/libraries/auth0-single-page-app-sdk). I call getTokenSilently() but the access token returned is only 32 characters long and clearly a different format. Am I missing a step to transform the client issued token into a JWT? This [gettokensilently-returns-a-32-character-string-not-jwt](https://community.auth0.com/t/gettokensilently-returns-a-32-character-string-not-jwt/34294) explains that you have to set the audience. I have tried setting the audience, restarting my SPA and double-checking that the options are being sent on login but I only ever receive a 32 char string, not a JWT. The code to get the AccessToken is thus: ``` const accessToken = await auth0.getTokenSilently(); console.log("Access Token") console.log(accessToken) ``` Note, I have not specifically configured any audience or scopes with Auth0 - it is pretty much vanilla setup. Your response appreciated. ---
**Author:** ![dan-auth0](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@dan-auth0](https://community.auth0.com/u/dan-auth0)\ **Post date:** [October 17, 2020, 10:01am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/4 "2020-10-17T10:01:58Z")
Howdy, @itinsley! Welcome to the Auth0 Community and thank you for reading the blog post. I am glad that you got the issue sorted out. That’s right, the audience parameters, which as you point out is the API Identifier in the Auth0 Dashboard, helps you get the access token needed to make API calls. This guide section is using the React SDK, but under the hood, that SDK uses the Auth0 SPA SDK: [The Complete Guide to React User Authentication with Auth0](https://auth0.com/blog/complete-guide-to-react-user-authentication/#Calling-an-API) It highlights the initialization needed to get an access token. Do you think that it would have been helpful to have included a demo client with this Rails blog post showing how to make protected API requests from a client to the Rails API? ---
**Author:** ![itinsley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/itinsley/32/24849_2.png) [@itinsley](https://community.auth0.com/u/itinsley)\ **Post date:** [October 30, 2020, 8:44am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/5 "2020-10-30T08:44:14Z")
Hi, thanks for getting back to me. Yeah, I imagine that what I was trying to do is pretty common. I was setting up a Rails API and a React Front-End with Auth0 for security but I had to work from two different tutorials and this audience setting was pretty critical and took a while to find as I don’t think it is mentioned in the auth0-spa-js tutorial ---
**Author:** ![yonyossef](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yonyossef/32/26626_2.png) [@yonyossef](https://community.auth0.com/u/yonyossef)\ **Post date:** [January 2, 2021, 11:08am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/6 "2021-01-02T11:08:17Z")
Hello, I’m following this guide for building my first Rails 6 + Auth0 API, Buy I’ve encountered an issue I can’t find a solution to, please help me understand where to look for an answer: I’m trying to make a first authenticated ‘create’ action by running: **curl -H “Content-Type: application/json” -H “Authorization: bearer $API\_TOKEN” -d ‘{“body”:“this is my first chirp!”, “published”:true}’ -X POST [http://localhost:3000/chirps](http://localhost:3000/chirps)** My server responds with the following error: **Errno::ECONNREFUSED (Failed to open TCP connection to :80 (Connection refused - connect(2) for nil port 80)):** **app/lib/json\_web\_token.rb:19:in `jwks_hash'** **app/lib/json_web_token.rb:14:in `block in verify’** **app/lib/json\_web\_token.rb:7:in `verify'** **app/services/authorization_service.rb:20:in `verify\_token’** **app/services/authorization\_service.rb:8:in `authenticate_request!'** **app/controllers/secured_controller.rb:7:in `authorize\_request’** **127.0.0.1 - - [02/Jan/2021:12:54:19 IST] “POST /chirps HTTP/1.1” 500 19247** **- → /chirps** My environment is Ubuntu 20.04.1 LTS under WSL2: **PS C:\Users\YOLA\> wsl -l -v** NAME STATE VERSION Ubuntu Running 2 Rails Server: **=\> Booting WEBrick** **=\> Rails 6.0.3.4 application starting in development [http://localhost:3000](http://localhost:3000)** Thanks! Yony ---
**Author:** ![dan-auth0](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@dan-auth0](https://community.auth0.com/u/dan-auth0)\ **Post date:** [January 4, 2021, 9:21pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/7 "2021-01-04T21:21:52Z")
Howdy, Yonyossef! Thanks for reading this blog post 🙂 Could you please try using `https` in the request URL instead of `http`? ---
**Author:** ![yonyossef](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yonyossef/32/26626_2.png) [@yonyossef](https://community.auth0.com/u/yonyossef)\ **Post date:** [January 5, 2021, 2:28am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/8 "2021-01-05T02:28:23Z")
`curl -H “Content-Type: application/json” -H “Authorization: bearer $API_TOKEN” -d ‘{“body”:“this is my first chirp!”, “published”:true}’ -X POST https://localhost:3000/chirps` Results in: `curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number` ---
**Author:** ![James.Morrison](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/james.morrison/32/13507_2.png) [@James.Morrison](https://community.auth0.com/u/James.Morrison)\ **Post date:** [January 31, 2021, 6:28pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/9 "2021-01-31T18:28:30Z")
This topic was automatically closed 26 days after the last reply. New replies are no longer allowed. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [March 7, 2022, 2:31pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/10 "2022-03-07T14:31:24Z")
---
**Author:** ![Intimaria](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/intimaria/32/37687_2.png) [@Intimaria](https://community.auth0.com/u/Intimaria)\ **Post date:** [May 28, 2022, 1:45am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/11 "2022-05-28T01:45:33Z")
Hi! Thanks for the great docs. I’m building a secured API with Auth0 on Rails 6 and have followed the Rails 6 tutorial. Am testing with test tokens for my application. I am just using authorisation not authentication. When testing secured endpoints, I was getting unauthorised access repeatedly so I debugged my code as far as I could & traced the problem to the verify method. Specifically the error is ```auto { "message": "Signature verification raised" } ``` If I set the third parameter in JWT.decode to false, everything works out. But this is not OK, I want to verify the JWT. So what could be going wrong? I have checked that the domain and audience are exactly in my code as they are in the auth0 issues JWTs, down the the trailing slash in the domain. I found [some](https://stackoverflow.com/questions/63238236/error-reproducing-auth0-instructions-on-ruby-on-rails-api-authentication) people having [similar issues](https://stackoverflow.com/questions/40721209/having-trouble-decoding-an-auth0-token) online but not a satisfying answer! If I follow the jwts link ([https://dev-lmzlz5ay.us.auth0.com/.well-known/jwks.json](https://dev-lmzlz5ay.us.auth0.com/.well-known/jwks.json)) I get a public key, and it does seem to process it (I verified this with a logger), but something fails in the verification step. If I try the JsonWebToken.verify() method out on the console with a test token from auth0, it verifies & returns the token just fine. But it doesn’t do so with http requests using postman or curl. Sorry, am a bit new with all of this! Happy to post any necessary snippets or logs. All the best, Inti ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [May 30, 2022, 6:30am UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/12 "2022-05-30T06:30:36Z")
@robertino.calcaterra would you be able to follow up on that? Thanks! ---
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [May 30, 2022, 12:43pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/13 "2022-05-30T12:43:31Z")
Hi folks! We are working on that @konrad.sopala 🧑‍💻 ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [May 30, 2022, 1:02pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/14 "2022-05-30T13:02:30Z")
Perfect! Thank you a lot! ---
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [May 31, 2022, 12:21pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/15 "2022-05-31T12:21:21Z")
Howdy @intimaria. I suggest to take a look at this post: [https://auth0.com/blog/secure-rails-api/](https://auth0.com/blog/secure-rails-api/), I think it’s very useful for you! ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [May 31, 2022, 1:14pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/16 "2022-05-31T13:14:25Z")
As far as I understand, your code works correctly when you run it on your console but not when it runs in your API 🤔 > If I try the JsonWebToken.verify() method out on the console with a test token from auth0, it verifies & returns the token just fine. It makes me think that something between your client (curl or Postman) and your `JsonWebToken.verify()` method modifies the token. Have you tried to debug your code and catch the token right before calling the `JsonWebToken.verify()` method? ---
**Author:** ![Intimaria](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/intimaria/32/37687_2.png) [@Intimaria](https://community.auth0.com/u/Intimaria)\ **Post date:** [May 31, 2022, 4:51pm UTC](https://community.auth0.com/t/building-secure-apis-with-rails-6-and-auth0/44674/17 "2022-05-31T16:51:12Z")
Thanks for your help! I used a Rails.logger to see what was going on and effectively there did seem to be some discrepancy between what was sent and received due to formatting. I was able to solve it effectively, so thank you for your help.