Skip to main content

Protect your Ruby on Rails API with RBAC and JWT validation

This guide will help you implement authorization to secure your Ruby on Rails APIs using Role-based access control (RBAC) and JSON Web Tokens (JWTs) issued by Logto.

Before you start​

Your client applications need to obtain access tokens from Logto. If you haven't set up client integration yet, check out our Quick starts for React, Vue, Angular, or other client frameworks, or see our Machine-to-machine guide for server-to-server access.

This guide focuses on the server-side validation of those tokens in your Ruby on Rails application.

A figure showing the focus of this guide

What you will learn​

  • JWT validation: Learn to validate access tokens and extract authentication information
  • Middleware implementation: Create reusable middleware for API protection
  • Permission models: Understand and implement different authorization patterns:
    • Global API resources for application-wide endpoints
    • Organization permissions for tenant-specific feature control
    • Organization-level API resources for multi-tenant data access
  • RBAC integration: Enforce role-based permissions and scopes in your API endpoints

Prerequisites​

  • Latest stable version of Ruby installed
  • Basic understanding of Ruby on Rails and web API development
  • A Logto application configured (see Quick starts if needed)

Permission models overview​

Before implementing protection, choose the permission model that fits your application architecture. This aligns with Logto's three main authorization scenarios:

Global API resources RBAC
  • Use case: Protect API resources shared across your entire application (not organization-specific)
  • Token type: Access token with global audience
  • Examples: Public APIs, core product services, admin endpoints
  • Best for: SaaS products with APIs used by all customers, microservices without tenant isolation
  • Learn more: Protect global API resources

💡 Choose your model before proceeding - the implementation will reference your chosen approach throughout this guide.

Quick preparation steps​

Configure Logto resources & permissions​

  1. Create API resource: Go to Console → API resources and register your API (e.g., https://api.yourapp.com)
  2. Define permissions: Add scopes like read:products, write:orders – see Define API resources with permissions
  3. Create global roles: Go to Console → Roles and create roles that include your API permissions – see Configure global roles
  4. Assign roles: Assign roles to users or M2M applications that need API access
New to RBAC?:

Start with our Role-based access control guide for step-by-step setup instructions.

Update your client application​

Request appropriate scopes in your client:

The process usually involves updating your client configuration to include one or more of the following:

  • scope parameter in OAuth flows
  • resource parameter for API resource access
  • organization_id for organization context
Before you code:

Make sure the user or M2M app you are testing has been assigned proper roles or organization roles that include the necessary permissions for your API.

Initialize your API project​

To initialize a new Rails API project, you can use the Rails generator:

rails new your-api-name --api
cd your-api-name

Start the development server:

rails server

Create a basic API controller:

app/controllers/api/base_controller.rb
class Api::BaseController < ApplicationController
  def index
    render json: { message: 'Hello from Rails API' }
  end
end

Add routes:

config/routes.rb
Rails.application.routes.draw do
  namespace :api do
    root 'base#index'
  end
end
note:

Refer to the Rails documentation for more details on how to set up controllers, models, and other features.

Initialize constants and utilities​

Define necessary constants and utilities in your code to handle token extraction and validation. A valid request must include an Authorization header in the form Bearer <access_token>.

auth_constants.rb
module AuthConstants
  JWKS_URI = 'https://your-tenant.logto.app/oidc/jwks'
  ISSUER = 'https://your-tenant.logto.app/oidc'
end
auth_info.rb
class AuthInfo
  attr_accessor :sub, :client_id, :organization_id, :scopes, :audience

  def initialize(sub, client_id = nil, organization_id = nil, scopes = [], audience = [])
    @sub = sub
    @client_id = client_id
    @organization_id = organization_id
    @scopes = scopes
    @audience = audience
  end

  def to_h
    {
      sub: @sub,
      client_id: @client_id,
      organization_id: @organization_id,
      scopes: @scopes,
      audience: @audience
    }
  end
end
authorization_error.rb
class AuthorizationError < StandardError
  attr_reader :status

  def initialize(message, status = 403)
    super(message)
    @status = status
  end
end
auth_helpers.rb
module AuthHelpers
  def extract_bearer_token(request)
    authorization = request.headers['Authorization']

    raise AuthorizationError.new('Authorization header is missing', 401) unless authorization
    raise AuthorizationError.new('Authorization header must start with "Bearer "', 401) unless authorization.start_with?('Bearer ')

    authorization[7..-1] # Remove 'Bearer ' prefix
  end
end

Retrieve info about your Logto tenant​

You’ll need the following values to validate Logto-issued tokens:

  • JSON Web Key Set (JWKS) URI: The URL to Logto’s public keys, used to verify JWT signatures.
  • Issuer: The expected issuer value (Logto’s OIDC URL).

First, find your Logto tenant’s endpoint. You can find it in various places:

  • In the Logto Console, under Settings → Domains.
  • In any application settings where you configured in Logto, Settings → Endpoints & Credentials.

Fetch from OpenID Connect discovery endpoint​

These values can be retrieved from Logto’s OpenID Connect discovery endpoint:

https://<your-logto-endpoint>/oidc/.well-known/openid-configuration

Here’s an example response (other fields omitted for brevity):

{
  "jwks_uri": "https://your-tenant.logto.app/oidc/jwks",
  "issuer": "https://your-tenant.logto.app/oidc"
}

Since Logto doesn't allow customizing the JWKS URI or issuer, you can hardcode these values in your code. However, this is not recommended for production applications as it may increase maintenance overhead if some configuration changes in the future.

  • JWKS URI: https://<your-logto-endpoint>/oidc/jwks
  • Issuer: https://<your-logto-endpoint>/oidc

Validate the token and permissions​

After extracting the token and fetching the OIDC config, validate the following:

  • Signature: JWT must be valid and signed by Logto (via JWKS).
  • Issuer: Must match your Logto tenant’s issuer.
  • Audience: Must match the API’s resource indicator registered in Logto, or the organization context if applicable.
  • Expiration: Token must not be expired.
  • Permissions (scopes): Token must include required scopes for your API/action. Scopes are space-separated strings in the scope claim.
  • Organization context: If protecting organization-level API resources, validate the organization_id claim.

See JSON Web Token to learn more about JWT structure and claims.

What to check for each permission model​

The claims and validation rules differ by permission model:

  • Audience claim (aud): API resource indicator
  • Organization claim (organization_id): Not present
  • Scopes (permissions) to check (scope): API resource permissions

For non-API organization permissions, the organization context is represented by the aud claim (e.g., urn:logto:organization:abc123). The organization_id claim is only present for organization-level API resource tokens.
tip:

Always validate both permissions (scopes) and context (audience, organization) for secure multi-tenant APIs.

Add the validation logic​

We use the jwt gem to validate JWTs. Add it to your Gemfile:

Gemfile
gem 'jwt'
# net-http is part of Ruby standard library since Ruby 2.7, no need to add explicitly

Then run:

bundle install

First, add these shared utilities to handle JWKS and token validation:

jwt_validator.rb
require 'jwt'
require 'net/http'
require 'json'

class JwtValidator
  include AuthHelpers

  def self.fetch_jwks
    @jwks ||= begin
      uri = URI(AuthConstants::JWKS_URI)
      response = Net::HTTP.get_response(uri)
      raise AuthorizationError.new('Failed to fetch JWKS', 401) unless response.is_a?(Net::HTTPSuccess)

      jwks_data = JSON.parse(response.body)
      JWT::JWK::Set.new(jwks_data)
    end
  end

  def self.validate_jwt(token)
    jwks = fetch_jwks

    # Let JWT library handle algorithm detection from JWKS
    decoded_token = JWT.decode(token, nil, true, {
      iss: AuthConstants::ISSUER,
      verify_iss: true,
      verify_aud: false, # We'll verify audience manually based on permission model
      jwks: jwks
    })[0]

    verify_payload(decoded_token)
    decoded_token
  end

  def self.create_auth_info(payload)
    scopes = payload['scope']&.split(' ') || []
    audience = payload['aud'] || []

    AuthInfo.new(
      payload['sub'],
      payload['client_id'],
      payload['organization_id'],
      scopes,
      audience
    )
  end

  def self.verify_payload(payload)
    # Implement your verification logic here based on permission model
    # This will be shown in the permission models section below
  end
end

Then, implement the middleware to verify the access token:

app/controllers/concerns/jwt_authentication.rb
module JwtAuthentication
  extend ActiveSupport::Concern
  include AuthHelpers

  included do
    before_action :verify_access_token, only: [:protected_action] # Add specific actions
  end

  private

  def verify_access_token
    begin
      token = extract_bearer_token(request)
      decoded_token = JwtValidator.validate_jwt(token)

      # Store auth info for generic use
      @auth = JwtValidator.create_auth_info(decoded_token)

    rescue AuthorizationError => e
      render json: { error: e.message }, status: e.status
    rescue JWT::DecodeError, JWT::VerificationError, JWT::ExpiredSignature => e
      render json: { error: 'Invalid token' }, status: 401
    end
  end
end

According to your permission model, implement the appropriate verification logic in JwtValidator:

jwt_validator.rb
def self.verify_payload(payload)
  # Check audience claim matches your API resource indicator
  audiences = payload['aud'] || []
  unless audiences.include?('https://your-api-resource-indicator')
    raise AuthorizationError.new('Invalid audience')
  end

  # Check required scopes for global API resources
  required_scopes = ['api:read', 'api:write'] # Replace with your actual required scopes
  token_scopes = payload['scope']&.split(' ') || []

  unless required_scopes.all? { |scope| token_scopes.include?(scope) }
    raise AuthorizationError.new('Insufficient scope')
  end
end

Apply the middleware to your API​

Now, apply the middleware to your protected API routes.

app/controllers/application_controller.rb
class ApplicationController < ActionController::API # For API-only apps
# class ApplicationController < ActionController::Base # For full Rails apps
  include JwtAuthentication
end
app/controllers/api/protected_controller.rb
class Api::ProtectedController < ApplicationController
  before_action :verify_access_token

  def index
    # Access auth information from @auth
    render json: { auth: @auth.to_h }
  end
end
config/routes.rb
Rails.application.routes.draw do
  namespace :api do
    resources :protected, only: [:index]
  end
end

Test your protected API​

Get access tokens​

From your client application: If you've set up a client integration, your app can obtain tokens automatically. Extract the access token and use it in API requests.

For testing with curl/Postman:

  1. User tokens: Use your client app's developer tools to copy the access token from localStorage or the network tab

  2. Machine-to-machine tokens: Use the client credentials flow. Here's a non-normative example using curl:

    curl -X POST https://your-tenant.logto.app/oidc/token \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "grant_type=client_credentials" \
      -d "client_id=your-m2m-client-id" \
      -d "client_secret=your-m2m-client-secret" \
      -d "resource=https://your-api-resource-indicator" \
      -d "scope=api:read api:write"

    You may need to adjust the resource and scope parameters based on your API resource and permissions; an organization_id parameter may also be required if your API is organization-scoped.

tip:

Need to inspect the token contents? Use our JWT decoder to decode and verify your JWTs.

Test protected endpoints​

Valid token request
curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  http://localhost:3000/api/protected

Expected response:

{
  "auth": {
    "sub": "user123",
    "clientId": "app456",
    "organizationId": "org789",
    "scopes": ["api:read", "api:write"],
    "audience": ["https://your-api-resource-indicator"]
  }
}
Missing token
curl http://localhost:3000/api/protected

Expected response (401):

{
  "error": "Authorization header is missing"
}
Invalid token
curl -H "Authorization: Bearer invalid-token" \
  http://localhost:3000/api/protected

Expected response (401):

{
  "error": "Invalid token"
}

Permission model-specific testing​

Test scenarios for APIs protected with global scopes:

  • Valid scopes: Test with tokens that include your required API scopes (e.g., api:read, api:write)
  • Missing scopes: Expect 403 Forbidden when token lacks required scopes
  • Wrong audience: Expect 403 Forbidden when audience does not match the API resource
# Token with missing scopes - expect 403
curl -H "Authorization: Bearer token-without-required-scopes" \
  http://localhost:3000/api/protected

Further reading​

RBAC in practice: Implementing secure authorization for your application

Build a multi-tenant SaaS application: A complete guide from design to implementation