Doorkeeper without web views

Question

I'm using Rails to write an API for mobile application and OAuth seems like a standard way to handle user authorization.

If I understand Doorkeeper docs correctly it requires user to be signed in with the website before it grants access for the mobile app.

The issue in may case is that there really isn't any website (it may be in the future but for now it's just api). I would like the user creation/signing in etc be handled in the ios application.

This makes me wonder if OAuth is the correct solution here?

Answer 1

The OAuth "Resource Owner Password Credentials Grant," according to rfc6749 Section 4.3, will grant an authorization token and optionally a refresh token given user name and password. Thus the mobile app doesn't have to store user name and password to gain authorized access. It becomes like a long running session using token and refresh token. OAuthClientSetup an iOS example that runs against a doorkeeper api.

So there is the OAuth method for gaining authorization without having web site login authentication and access grant.

What is left is how to register new users from your mobile app. Agree that does not look to be covered by OAuth. OmniAuth will let you register a user authorized by a third party site. You allow the user to be the user they are on Twitter or FaceBook, StackOverflow or GitHub or wherever else. Maybe that would help.