Problem
Dealerware authenticated with a session token generated by Devise. On an API that meant Rack session state, on a single thread — session semantics carrying an interface that has no sessions. It worked, but it was the wrong shape for what the platform had become.
On top of that, every new OEM partner meant custom authentication code. Slow to ship, risky to maintain, and no clean path to adding identity providers.
Action
Migrated to Auth0 with JWT and role-based access control, designed provider-agnostic from the ground up: one integration layer with a SAML connection per partner, rather than one-off code per partner.
Result
33,000+ users onboarded through a single migration. 60,000+ in daily use across the federated providers — Holman, Nissan, Volvo, Audi and others.
Every provider after the first required only a SAML connection configuration, with zero code changes. Zero downtime during the migration itself.