User authentication & login

RailsFast comes with an entire user authentication and login system. We leverage the devise gem for that.

Of course, the main thing it handles is user signup and login:

But on top of that, it also handles things like "Forgot your password?" and "Resend email confirmation" flows:

All this with beautiful transactional emails that will work out of the box if you followed the quickstart:

Abuse protection

If you've configured your Cloudflare Turnstile credentials, you'll see the Turnstile captcha protecting all your user forms against bots and abuse:

There's no need for you to configure anything other than your Turnstile credentials as outlined in the quickstart, it all works automatically (you'll see a placeholder in development, and the real Cloudflare Turnstile widget once your app is deployed to production)

Block disposable emails

RailsFast automatically blocks users using disposable emails from signing up to your app. This comes working out of the box, there's nothing you need to do to make it work.

If a user tries to create an account with a disposable email address like [email protected], they'll get blocked and see an alert like this:

The list of disposable email providers gets automatically updated in production every night (check your recurring.yml file!)

We leverage the nondisposable gem for this, which gets its updated list of known disposable email providers from the disposable-email-domains list.

---

Sessions, devices & login activity

Every RailsFast app tracks signed-in devices and login activity by default via the sessions gem: a "Sessions & devices" page in Settings with remote sign-out, an append-only login trail, new-device security emails, and an admin Security section. See Sessions & devices for the full picture.

Self-serve API keys (opt-in)

If your product exposes an API and you want users to mint and manage their own API keys (with scoping, expiry, and a self-serve UI), uncomment gem "api_keys" in the Gemfile, run bin/rails generate api_keys:install && bin/rails db:migrate, add has_api_keys to your User model, and uncomment the mount ApiKeys::Engine line already waiting in config/routes.rb — that gives you a self-serve keys dashboard under Settings. Then gate your API controllers by including ApiKeys::Controller and adding before_action :authenticate_api_key! (per-endpoint scopes via authenticate_api_key!(scope: "write")). Full details in the api_keys README.