I have a user resource that looks more or less like that one in the Ash Authentication getting started doc, with one added field: role. Role can be one of admin, merchant, client. Only admins should be able to log in via the web frontend, merchants and clients should only be able to register and “sign in” (that is, receive a token) only via a JSON API.

At this time, I’m only interested in the password strategy.

On the web side, everything works well (registration is disabled, I seed an initial admin, who can log in and create more admins, if needed).

However, I cannot get authentication to work with the JSON API. I have followed the documentation for ash-authentication and ash-json-api as well as peeked at this: Ash authentication on mobile - #11 by lud which is the closest I have found to what I’m looking to do.

Right now I’m not sure if I have completely missunderstood everything or if I’m just missing out on some little part. I was expecting registration to be fairly straight-forward, but not even that seems to be working.

I have created a router as per the getting started guide for ash-json-api. Do I need a controller as well? The documentation says the router partly plays the role of a controller, the forum post above says to add a controller. I’m a bit lost here.

Could somebody explain the steps required to get authentication working together with JSON API? Or even better, if you are working on a project that does this and is open source, I unfortunately seem to be better at reading code than explanations, or so it would seem.