For API auth - phx.gen.auth or Pow?

[Exadra37]

API protection with tokens can be very easily implemented with Phoenix tokens, therefore no external dependencies needed.

Phoenix Token:

Tokens provide a way to generate and verify bearer tokens for use in Channels or API authentication.

Using a Phoenix Token per user:

Phoenix Token for API-auth, salt per user or per app?

So Phoenix Token doc specify that we must supply salt whenever we sign and verify. https://hexdocs.pm/phoenix/Phoenix.Token.html I want to use the token as bearer token to do API authentication in order to identify user, is that salt is special per user (stored in database) or is it a single secret string for everyone (app-wide)? If it is per user, then I need to supply the user id in the request API in order to get specific user’s salt in the database, which doesn’t make sense. If it is app…

How To’s:

Implement token Authentication with Phoenix.Token

Simple token authentication for Phoenix API

I am not saying that this the way you should go, but it’s na alternative you may want to consider due to it’s simplicity and no need of further dependencies.