Update the API Authentication.

lib/link_shortener_web/auth/error_handler.ex

@@ -0,0 +1,11 @@
+defmodule LinkShortenerWeb.Auth.ErrorHandler do
+  import Plug.Conn
+
+  def auth_error(conn, {type, _reason}, _opts) do
+    body = Poison.encode!(%{error: to_string(type)})
+    conn
+    |> put_resp_content_type("application/json")
+    |> send_resp(401, body)
+  end
+end
+

lib/link_shortener_web/auth/guardian.ex

@@ -0,0 +1,31 @@
+defmodule LinkShortenerWeb.Auth.Guardian do
+  use Guardian, otp_app: :link_shortener
+
+  alias LinkShortener.Accounts
+  alias LinkShortener.Accounts.User
+
+  def subject_for_token(user, _claims) do
+    {:ok, to_string(user.id)}
+  end
+
+  def resource_from_claims(%{"sub" => id}) do
+    user = Accounts.get_user!(id)
+    {:ok, user}
+  rescue
+    Ecto.NoResultsError -> {:error, :resource_not_found}
+  end
+
+  def authenticate(email, password) do
+    with user <- Accounts.get_user_by_email_and_password(email, password) do
+      case user do
+        %User{} -> create_token(user)
+        nil -> {:error, :unauthorized}
+      end
+    end
+  end
+
+  defp create_token(user) do
+    {:ok, token, _claims} = encode_and_sign(user)
+    {:ok, user, token}
+  end
+end

lib/link_shortener_web/auth/pipeline.ex

@@ -0,0 +1,9 @@
+defmodule LinkShortenerWeb.Auth.Pipeline do
+  use Guardian.Plug.Pipeline, otp_app: :link_shortener,
+    module: LinkShortenerWeb.Auth.Guardian,
+    error_handler: LinkShortenerWeb.Auth.ErrorHandler
+
+  plug Guardian.Plug.VerifyHeader
+  plug Guardian.Plug.EnsureAuthenticated
+  plug Guardian.Plug.LoadResource
+end