Add read-only permissions to your Rails API tokens

Slog app, my time tracking SaaS, exposes a public REST API following the JSONAPI specification. Authentication is straightforward: the user generates a personal API token from their profile, and sends it as a Bearer token. Simple, but until recently…