Rails API mode (rails new myapp --api) strips the asset pipeline, the view layer, and the session middleware, and turns Rails into a JSON API server that still has the full ORM, the migrations, the generators, and the admin scaffolding. The right answer is yes for a team that wants rails g model Post title:string to generate the model, the migration, the test, and the controller in 30 seconds. The wrong answer is Rails for a stateless edge service with no database work — the framework’s main benefit is the data layer, and the team that has no data is paying for overhead.
Table of contents
- The API-only mode — what gets stripped and what stays
- The serializers — the missing piece every team reinvents
- The auth pattern — token-based, not session-based
- The N+1 query problem — the hidden cost of the ORM
- When to pick Rails API (and when not to)
- How this fits the rest of the stack
- FAQ
The API-only mode — what gets stripped and what stays
The rails new myapp --api command does three things: it removes the asset pipeline (no Sprockets, no Webpacker by default), it removes the view layer (no ERB, no layout), and it removes the session middleware (no cookies by default — the auth is via tokens). What stays: the ORM (ActiveRecord), the migrations, the generators, the testing framework (Minitest or RSpec), the admin scaffolding (RailsAdmin, ActiveAdmin), the routing DSL, the console, the migrations, the entire data layer.
The right answer is API mode for a team that needs a database-backed JSON API and is willing to live with Rails’ opinions. The wrong answer is API mode for a team that has no database work — the team is paying for ActiveRecord and using nothing.
The serializers — the missing piece every team reinvents
Rails ships with render json: @object, which serializes the object’s attributes to JSON. The gotcha: render json: @post serializes the post’s columns, but it also serializes the post’s associations (the comments, the author, the tags) recursively. The team’s first API call returns 50MB of nested JSON, and the production client crashes.
The right answer is a serializer library: active_model_serializers (the older, simpler option) or jsonapi-serializer (the faster, JSON:API-spec option). The serializer is a class that defines which attributes and associations are included in the JSON, and the controller renders the serializer’s output.
The auth pattern — token-based, not session-based
Rails API mode disables session middleware by default. The right answer is token-based auth: the team uses has_secure_password (BCrypt) for the password hash, generates a token on login (with JWT or SecureRandom), and validates the token on every request. The wrong answer is to roll a custom password hash — bcrypt is the standard, and the team’s custom hash will be worse.
The right answer for a team that wants zero-config auth is a third-party auth library (Devise + devise-jwt, Auth0, Clerk). The right answer for a team that wants full control is the homegrown pattern with has_secure_password + JWT.
The N+1 query problem — the hidden cost of the ORM
The team’s first API call returns a list of 100 posts, and the API takes 8 seconds. The team profiles, finds 101 database queries (1 for the list, 100 for each post’s author), and the response time drops to 80ms with one fix: Post.includes(:author). The N+1 is the most common Rails API performance bug, and it is invisible until the list size grows.
The right answer is to use includes (preload) or eager_load on every association that the serializer touches. The wrong answer is to ignore the N+1 until the production alert fires. The right answer for a team that wants to catch the N+1 in dev is the bullet gem, which adds N+1 warnings to the dev log.
When to pick Rails API (and when not to)
Pick Rails API when the team wants the ORM, the migrations, the admin, the convention over configuration, and is willing to live with Rails’ opinions on the data layer. The right answer is yes for a startup shipping the first version with a Postgres database, a small team that wants to ship in 2-4 weeks, a team that has been struggling with the integration layer between the database and the API.
Don’t pick Rails when the team wants a stateless edge service with no database, wants to be on the Node ecosystem for staffing reasons, or wants a framework that has a smaller deploy footprint. The right answer for those cases is a Node framework (FastAPI, Express, NestJS).
How this fits the rest of the stack
The infrastructure question is a small piece of a larger pattern: the team’s runtime, storage, database, secret store, logs, and deployment platform are all parts of the same platform. The right answer is to model the full stack before the project ships, not after. The RunxBuild hosting calculator is the right place to do that exercise — pick the runtime, the memory tier, the storage, the secret store, and the egress, and the calculator shows what the deploy actually costs at the team’s actual usage.
Useful related references:
FAQ
What is Rails API mode?
rails new myapp --api strips the asset pipeline, the view layer, and the session middleware, and turns Rails into a JSON API server that still has the full ORM, migrations, generators, and admin scaffolding.
Is Rails API still relevant in 2026?
Yes. The right answer is yes for a team that wants the ORM, the migrations, the admin, and the convention over configuration.
How do I add auth to a Rails API?
Use Devise + devise-jwt for a full-featured solution, or has_secure_password + JWT for a homegrown solution.
How do I fix the N+1 query in Rails?
Use includes(:author) on the query, or eager_load(:author) for a JOIN-based load. The bullet gem adds N+1 warnings to the dev log.
What is the best serializer for Rails API?
active_model_serializers for the simpler case, jsonapi-serializer (formerly fast_jsonapi) for the JSON:API-spec case.
How do I deploy a Rails API?
The right answer is a managed platform with a Ruby runtime, a managed Postgres, and a managed deploy pipeline. Render, Fly.io, Railway, or a Heroku-style PaaS.
Is Rails faster than Node?
Rails is faster for the typical CRUD workload. Node is faster for I/O-bound workloads. Pick the framework that matches the workload.
What is the difference between Rails API and Sinatra?
Rails API is the full Rails framework with the views stripped. Sinatra is a minimal Ruby web framework (similar to Flask).