In this situation, the developers must have access to the master key which would expose production secrets to more people than necessary. This of course depends on the layout of the R&D team. If it is a solo developer working on a personal project then the exposure is obviously limited. However, in a larger setting, often the developers will not have access nor the secrets to the production environment.

I have been considering to do something like this even though it is outside of the scope of Ruby. What are peoples' thoughts? Android or iOS example?

very good point

See if this episode helps out. It uses `devise` and the `knock` gem for JWT authentication. https://www.driftingruby.com/episodes/rails-api-authentication-with-jwt

It looks like the cURL request may be malformed as it is setting the parameter's key as the full hash and the [FILTERED] part is the value.