Help with iOS authentication using user token, rest/rails, and keychain
We've used this approach with iOS connecting with Rails apps and haven't had any issues. In your api controllers, just have a before filter that finds your user based on your token, and returns a 401 if it's not valid.
Then, your mobile device knows if it receives a 401, then show the login screen to get a new/valid token. Put that in a connection factory and you'll be good to go.
You can also add it to the header if you want to keep the URLs clean, but I've had no problems with the URL param approach.