In my humble opinion, this seems essential to phx_gen_auth if it is to become part of the standard Phoenix framework. A lot of people use Phoenix just for their API, so a lot of people will want to be able to do:
mix phx.new --no-html --gen-auth # I don't know what the actual flag will be
It already is merged in to phoenix and it’s still a valid tool even if limited to session based authentication with logins – especially given how much more diverse, with various different tradeoffs, authentication for api’s is.
I’m often puzzled at the dismissal for APIs and their technologies in this forum. I’ve seen multiple API authentication questions be shot down immediately here: “JWT is unsafe”, “tokens are unsafe”… That’s understandable, but we have to authenticate our single page apps somehow, and people use tokens.
It’s the difference between theory and pragmatism.
As someone who’s new to Elixir and Phoenix, it’s incredibly off-putting and a shame considering how suitable Phoenix is for the task of building APIs. It’s a pleasure.
It’s not about token, it’s about JWT versus Phoenix Token…
It’s not about Phoenix API, it’s about API in general 
And I agree Phoenix is really nice to build API.
Thanks for the clarification, it’s just been a little frustrating as someone new to the community who’s been trying to implement an auth solution for API use.
I’ve seen tons of questions spiral into theoretical debates and not get solved, and I wish that wasn’t the case, because it can be very difficult for beginners like me to find up-to-date information and pointers.
I’ll likely be writing a tutorial sometime on implementing API auth, once I get a little bit better at Phoenix and Elixir
And yes, Phoenix rocks for API development. It’s a pleasure.
The problem is how people use jwt for authentication, it’s not really done for that.
Nothing related to Phoenix, except we can use Phoenix Token instead as they are lighter than jwt.
Thank you for the pointers. What solution can we use for API centric/SPA development?
Do Phoenix tokens store information like user ID securely, to easily use it in a Plug?
Thanks!
It stores whatever You want…
The only difference is Phoenix Token cannot be decrypted client side, while JWT can be.
Isn’t that a possible benefit though?
The cool thing about claims on JWT is that you can use them on the client and store arbitrary data (say a user object) and not have to fetch that data on client again, unless to update it regularly.
e.g. you store a token in client, and in first load you have the user’s profile already loaded, rather than doing another roundtrip to the server or storing it in local storage.
Afaik they can be decrypted, but not modified, no?