{"action":"closed","issue":{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/154","labels_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/154/labels{/name}","comments_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/154/comments","events_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/154/events","html_url":"https://github.com/gonzalo-bulnes/simple_token_authentication/issues/154","id":58733513,"number":154,"title":"Authentication doesn't work","user":{"login":"giedriusr","id":210713,"avatar_url":"https://avatars.githubusercontent.com/u/210713?v=3","gravatar_id":"","url":"https://api.github.com/users/giedriusr","html_url":"https://github.com/giedriusr","followers_url":"https://api.github.com/users/giedriusr/followers","following_url":"https://api.github.com/users/giedriusr/following{/other_user}","gists_url":"https://api.github.com/users/giedriusr/gists{/gist_id}","starred_url":"https://api.github.com/users/giedriusr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/giedriusr/subscriptions","organizations_url":"https://api.github.com/users/giedriusr/orgs","repos_url":"https://api.github.com/users/giedriusr/repos","events_url":"https://api.github.com/users/giedriusr/events{/privacy}","received_events_url":"https://api.github.com/users/giedriusr/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-24T12:47:53Z","updated_at":"2015-02-25T10:14:05Z","closed_at":"2015-02-25T10:14:05Z","body":"Hello,\r\n\r\nI am allowed to access my controller action without protection. It should throw `401`, but I get `200` instead. What's wrong? If I remove `fallback_to_devise: false`, I always get `401`.\r\n\r\nEDIT: apparently I need to render 401 explicitly.\r\n\r\n```ruby\r\n# Gemfile\r\nsource 'https://rubygems.org'\r\n\r\ngem 'rails',                         '4.2.0'\r\ngem 'rails-api'\r\ngem 'devise'\r\ngem 'simple_token_authentication',   '~> 1.0'\r\n```\r\n\r\n```ruby\r\n# controllers/application_controller.rb\r\nclass ApplicationController < ActionController::API\r\nend\r\n\r\n# controllers/api/v3/home_controller.rb\r\nclass Api::V3::HomeController < ApplicationController\r\n  acts_as_token_authentication_handler_for User, fallback_to_devise: false\r\n\r\n  def index\r\n    render json: { message: 'You are successfully authenticated!' }\r\n  end\r\nend\r\n\r\n```\r\n\r\n```ruby\r\n# routes.rb\r\nRails.application.routes.draw do\r\n  devise_for :users\r\n\r\n  namespace :api, defaults: { format: :json } do\r\n    namespace :v3 do\r\n      get '/home', to: 'home#index'\r\n    end\r\n  end\r\n\r\n  match '(*path)', to: 'errors#routing', via: :all\r\nend\r\n```\r\n\r\n```ruby\r\n# models/user.rb\r\nclass User < ActiveRecord::Base\r\n  acts_as_token_authenticatable\r\n\r\n  devise :database_authenticatable, :lockable,\r\n         :recoverable, :trackable, :validatable\r\n\r\n  validates :first_name, :last_name, :email, :password, presence: true\r\nend\r\n```"}}