Commit 515dafb

@@ -0,0 +1,5 @@
+class Api::Controller < ActionController::Base
+  # Prevent CSRF attacks by raising an exception.
+  # For APIs, you may want to use :null_session instead.
+  protect_from_forgery with: :exception
+end

@@ -0,0 +1,7 @@
+class Api::SessionsController < Api::Controller
+  def create
+    user_session = User.login(params[:username], params[:password])
+    token = user_session.access(request)
+    render json: { authentication_token: token }
+  end
+end

@@ -14,4 +14,8 @@ Rails.application.routes.draw do
 
   get "/email/incoming", to: proc { [200, {}, ["OK"]] }
   post "/email/incoming" => "griddler/emails#create"
+
+  namespace :api, defaults: { format: 'json' }  do
+    resources :sessions, only: [:create]
+  end
 end

@@ -0,0 +1,14 @@
+require 'rails_helper'
+
+describe Api::SessionsController do
+  describe "#create" do
+    let(:user) { create(:user, password: 'password') }
+
+    it 'returns a JSON Web Token' do
+      post :create, params: { username: user.username, password: 'password' }
+
+      json = JSON.parse(response.body)
+      expect(json['authentication_token']).to be_present
+    end
+  end
+end