Using sans_password to make an authenticated API

[mazz]

Great library.

I got login, email and magic tokens working and would like to know a secure way to implement a JWT API on top of it.

What I’m thinking is, the user can POST with their email address in the header of the POST. The app can then do

{:ok, magic_token, _claims} = MyApp.Guardian.send_magic_link(user)

Not email anything at this point but rather exchange_magic() in the same function:

{:ok, access_token, _claims} = MyApp.Guardian.exchange_magic(magic_token)

So at this point if either of the two calls above fail, the app just sends back a 401 or 403.

Is this sensible or even possible?

What I mean by a JWT API is something like here:

https://dev.to/miguelcoba/elixir-api-and-elm-spa---part-2-1pca