// the find
nsarno/knock
Seamless JWT authentication for Rails API
A Rails engine that wraps JWT authentication into controller concerns and a token endpoint. It was a reasonable shortcut in 2015–2018 for API-only Rails apps that didn't want to wire up Devise. The author has explicitly abandoned it and recommends using the jwt gem directly instead.
The concern-based API (include Knock::Authenticable, before_action :authenticate_user) is genuinely clean and requires almost no boilerplate. Support for multiple authenticatable entities (User, Admin, Vendor) without separate gems is handled elegantly. The from_token_request / from_token_payload hooks give you escape hatches without monkey-patching. Test helper pattern (constructing a real AuthToken in fixtures) is the right approach and avoids the magic-token antipattern.
Unmaintained since 2021, explicitly by the author's own README disclaimer — this is not a soft deprecation, it's a hard stop. Last Rails compatibility tested was Rails 5 (the gemfiles directory has no Rails 6/7/8 lockfile). No token revocation mechanism whatsoever — once issued, a token is valid until expiry, which is a real problem if you need logout or credential rotation. Returns 404 on invalid credentials rather than 401, which is a security-through-obscurity call that breaks standard HTTP semantics and will confuse any client expecting proper status codes.