{"action":"opened","issue":{"url":"https://api.github.com/repos/ga-dc/project2/issues/338","labels_url":"https://api.github.com/repos/ga-dc/project2/issues/338/labels{/name}","comments_url":"https://api.github.com/repos/ga-dc/project2/issues/338/comments","events_url":"https://api.github.com/repos/ga-dc/project2/issues/338/events","html_url":"https://github.com/ga-dc/project2/issues/338","id":117386219,"number":338,"title":"Saving Token","user":{"login":"tylercrosse","id":10747860,"avatar_url":"https://avatars.githubusercontent.com/u/10747860?v=3","gravatar_id":"","url":"https://api.github.com/users/tylercrosse","html_url":"https://github.com/tylercrosse","followers_url":"https://api.github.com/users/tylercrosse/followers","following_url":"https://api.github.com/users/tylercrosse/following{/other_user}","gists_url":"https://api.github.com/users/tylercrosse/gists{/gist_id}","starred_url":"https://api.github.com/users/tylercrosse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tylercrosse/subscriptions","organizations_url":"https://api.github.com/users/tylercrosse/orgs","repos_url":"https://api.github.com/users/tylercrosse/repos","events_url":"https://api.github.com/users/tylercrosse/events{/privacy}","received_events_url":"https://api.github.com/users/tylercrosse/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-17T15:59:15Z","updated_at":"2015-11-17T15:59:15Z","closed_at":null,"body":"I'm using Omniauth to handle logins to github. I've got my application registered (https://github.com/settings/applications/new) and the corresponding Client ID and Client Secret saved in an application.yml file hidden by figaro. Omniauth somehow passes this to github presumably by a file I created config/initializers/omniauth.rb\r\n```ruby\r\nRails.application.config.middleware.use OmniAuth::Builder do\r\n  provider :github, ENV['GITHUB_KEY'], ENV['GITHUB_SECRET']\r\nend\r\n```\r\n When a user logs in Omniauth sends back a bunch of stuff, including a auth hash (accessed by ```request.env['omniauth.auth']```). This hash includes some info on the user like name, image(avatar), and a token. This token according to the schema (https://github.com/intridea/omniauth/wiki/Auth-Hash-Schema) is supplied by OAuth and OAuth 2.0 providers, is the access token. I've got a callback method in my User model that creates a entry in my User table and populates it with info from the Omniauth auth_hash.\r\n```ruby\r\nclass User < ActiveRecord::Base\r\n  \r\n  def self.create_from_omniauth(auth_hash)\r\n    self.create(\r\n      provider: auth_hash[:provider],\r\n      uid: auth_hash[:uid],\r\n      name: auth_hash[:info][:name],\r\n      nickname: auth_hash[:info][:nickname],\r\n      image: auth_hash[:info][:image],\r\n      url: auth_hash[:extra][:raw_info][:html_url],\r\n    )\r\n  end\r\nend\r\n```\r\nI'm also storing the current user id in a session\r\n```ruby\r\nclass SessionsController < ApplicationController\r\n  def new\r\n    redirect_to '/auth/github'\r\n  end\r\n\r\n  def create\r\n    @user = User.find_by_provider_and_uid(auth_hash[:provider], auth_hash[:uid]) || User.create_from_omniauth(auth_hash)\r\n    if @user\r\n      session[:user_id] = @user.id\r\n      redirect_to root_url\r\n    binding.pry\r\n    else\r\n      redirect_to root_url\r\n    end\r\n  end\r\n\r\n  def destroy\r\n    reset_session\r\n    redirect_to root_url\r\n  end\r\n\r\n  protected\r\n    def auth_hash\r\n      request.env['omniauth.auth']\r\n    end\r\nend\r\n```\r\nI want to manipulate the github Api which has a pretty low rate limit unless users are authenticated. It looks like I can pass a token to Httparty using something that looks kind of like this -\r\n```ruby\r\nresponse = HTTParty.get(\r\n            \"https://api.github.com/user\", \r\n            :headers => {\r\n                \"Authorization\" => \"token #{token}\",\r\n                \"User-Agent\" => \"codecademy\"\r\n                })\r\n```\r\nI've been struggling with how these pieces fit together. How can I save the ```token``` in a way that I can access with HTTParty and also not be stored safely?"}}