How to secure RESTful API in a proper way with a dynamic token Rails -

what trying achieve:

i'm looking create (rest) api rails application. have looked securing api, versioning of api , api gems railscast implementation of api calls.

what solution railscasts:

i find myself stuck security of api. in securing api railscast have specified keep token each app i.e. instance let consider-

android app --> "android_token"

iphone app --> "iphone_token".

whats problem:

but concern if gets access token using network tethering or something. person can make indefinite calls app.

what possible solutions:

to cease should have dynamic session kind of thing app requests. pops in head:

1.why not generate different dynamic token each request , request should coupled same dynamic token response or maintain session using dynamic token , new token regenerated after lets 30 minutes or 50 calls.

just there gems devise perform user authentication in robust way. there gem or plugin can maintain api session secure threats.

firstly not more aware network tethering, have read , understand it. not expert in security of application want suggest solutions may helpful you.

managing application security token best way in view. there no way have found dynamic session, have found 1 solution may prevent user make request multiple device common access token. may store information of particular user in session remote ip, user-agent...i think answer @ : rails saving ip address every create/update request. , ruby on rails api security

hope above useful , create value in development.