How should I store a 3rd party API authentication token in a Rails app?
I am looking at using Savon to consume a SOAP API. One of the requirements of this particular API is that an authentication token be supplied in each request to the API. That is, apart from the request that returns the authentication token itself. That call just needs a username and password. The token expires after 20mins of inactivity.

My question is, what is the best practice for storing this token? It's surely not advisable to make two requests every time, one for the token and one for the actual request?

I was considering storing it in a session variable but this would mean generating a new token for each visitor, which I presume is not necessary. However, it would mean I could set a 20 minute expiry on it very easily though.

If I store it in the database, how would I know whether or not it will have expired before making the call to the API, without a lot of extra logic?

Or, should I store it in the database and simply make a background call to the API every few minutes to ensure the token never expires?

Or am I barking up completely the wrong tree?!

Thanks for any advice.
How should I store a 3rd party API authentication token in a Rails app?
===

I am looking at using Savon to consume a SOAP API. One of the requirements of this particular API is that an authentication token be supplied in each request to the API. That is, apart from the request that returns the authentication token itself. That call just needs a username and password. The token expires after 20mins of inactivity.

My question is, what is the best practice for storing this token? It's surely not advisable to make two requests every time, one for the token and one for the actual request?

I was considering storing it in a session variable but this would mean generating a new token for each visitor, which I presume is not necessary. However, it would mean I could set a 20 minute expiry on it very easily though.

If I store it in the database, how would I know whether or not it will have expired before making the call to the API, without a lot of extra logic?

Or, should I store it in the database and simply make a background call to the API every few minutes to ensure the token never expires?

Or am I barking up completely the wrong tree?!

Thanks for any advice.