devise-two-factor VS rodauth-rails

Your authentication mechanism should include multiple factors, something the user knows and something the user has. If you are using Devise, you can use the devise-two-factor gem. If you have custom authentication, you can use the rotp gem to generate OTP codes and verify those during login.

In Ruby-on-Rails it's part of the authentication framework Devise https://github.com/tinfoil/devise-two-factor and related modules including creating QR codes, backup codes etc. PHP Laraval has similar libraries https://jetstream.laravel.com/2.x/features/two-factor-authen...

Auth0 and similar commercial companies might very good at marketing. Try replacing "API" with "library" or a programming language name.

> It's just not valuable enough for anyone to create

For a commercial API you need to charge $10 USD/month, or equivalent in terms of per-API-call, otherwise your service won't be profitable. You call 5 US cent already expensive, so I think you're right, it's not valuable enough.

I've used https://github.com/tinfoil/devise-two-factor before – it's good to know there is a maintained alternative that implements the UI already and is compatible to Rails 7.

Are you referring to the devise two factor authentication gem at https://github.com/tinfoil/devise-two-factor? If so, I have posted a ticket that modifies the gem to use the Rails 7 Active Record encryption capabilities and some folks have been asking if a pull request could be created for it. There is some discussion going on in the issue thread on how to proceed. See https://github.com/tinfoil/devise-two-factor/issues/192 for details.

devise-two-factor: https://github.com/tinfoil/devise-two-factor

In this article, I would like to show how to set each of these up in a Rails app that uses rodauth-rails. I'll be using Safari on macOS Ventura, and have iCloud Keychain sync enabled, which is a requirement for Apple passkeys.

Once I felt things were functioning well enough, I extracted the glue code into the rodauth-rails gem and added tests. I also included an install generator, which created the initial skeleton with sensible default configuration. A new Roda superclass provided a convenience configure method for loading the Rodauth plugin together with the rails feature.

FWIW I'm using rodauth and I like it: https://github.com/janko/rodauth-rails

My question is pretty much in the title. Is it possible to do Omniauth in a Rails API Only app? I've been looking into devise-token-auth and rodauth-rails. rodauth-rails has a tutorial for Omniauth (https://github.com/janko/rodauth-rails/wiki/OmniAuth), but it is using a Rails monolith.

I didn't create it, it was created by Jeremy Evans, I just contribute to it occasionally ;). I created the Rails integration, because I wanted to bring it into the Rails ecosystem, and I recently started recording screencasts. So I'm biased in that sense :)

maybe https://github.com/janko/rodauth-rails

$/myapp> bundle info rodauth-rails * rodauth-rails (0.18.1) Summary: Provides Rails integration for Rodauth. Homepage: https://github.com/janko/rodauth-rails Path: /Users/shino/.rbenv/versions/3.0.0/lib/ruby/gems/3.0.0/gems/rodauth-rails-0.18.1

I don't know if you've seen, but I wrote a guide that shows an integration, which you can use for now. This is also what the official demo Rails app uses.