Devise_token_auth and Devise login with username and email

Hello **@lynndylanhurley**, I have the following problem:

I have a Rails application which uses the _Devise_ gem and I want to implement an **API**. I followed the steps to apply the _Devise_Token_Auth_ gem to my application which has an existing User model and database in order to add the needed columns for this gem.

The _**authentication_keys**_ module from the _Devise_ gem is configured like this:

`authentication_keys: [:login]
`

I have been looking into the **SessionsController** from _Devise_Token_Auth_ and if I don't add the keys _:username_ and _:email_ to the _**authentication_keys**_ it won't work because it neeeds them and throws the following error:

```
{
"success": false,
"errors": [
"Invalid username or password."
]
}

```
If I add these keys to my **_authentication_keys_** the **API** works but not the website, throwing this error:

`Invalid email or username, username, email or password.
`

I understand, according to this error, that with the _:login_ key it looks for an email or username and adding the _:email_ and _:username_ keys duplicates them, getting more parameters than needed.

So, my question is how I can split the **_authentication_keys_** between the **API** and the website or how could I make them work together. I hope to have explained myself clearly enough so you could lend me a hand.

Thanks ;).

Gem versions
---
- devise_token_auth 1.1.0
- devise 4.6.2

Request and response headers
---
```
X-Frame-Options →SAMEORIGIN
X-XSS-Protection →1; mode=block
X-Content-Type-Options →nosniff
Content-Type →application/json; charset=utf-8
Vary →Origin
Cache-Control →no-cache
X-Request-Id →5dc7b018-c41e-4620-b9a8-7e93ea989380
X-Runtime →10.709363
Transfer-Encoding →chunked
```

Rails Stacktrace
---
```
Started POST "/api/auth/sign_in" for ::1 at 2019-06-27 12:25:39 +0200
Processing by Api::DeviseTokenAuth::SessionsController#create as JSON
Parameters: {"email"=>"email@gmail.com", "password"=>"[FILTERED]"}
User Load (0.7ms) SELECT "users".* FROM "users" WHERE "users"."hidden_at" IS NULL AND "users"."id" = $1 ORDER BY "users"."id" ASC LIMIT $2 [["id", 5], ["LIMIT", 1]]
[active_model_serializers] Rendered ActiveModel::Serializer::Null with Hash (0.12ms)
Completed 401 Unauthorized in 6ms (Views: 0.7ms | ActiveRecord: 0.7ms)
```

Environmental Info
---
Routes:

```
namespace :api, defaults: {format: 'json'} do
scope module: :v1 do
mount_devise_token_auth_for 'User', at: 'auth', controllers: {
sessions: 'api/devise_token_auth/sessions'
}
end
end
```
Gems :
- Cancancan

Custom Overrides:

**app/controllers/custom/api/devise_token_auth/sessions_controller.rb**
```
class Api::DeviseTokenAuth::SessionsController < ::DeviseTokenAuth::SessionsController

before_action :authenticate_user!, unless: :devise_controller?

before_action :authenticate_user!, except: [:new, :create, :validate_token]

before_action :configure_permitted_parameters, if: :devise_controller?

skip_before_action :verify_authenticity_token

wrap_parameters format: []

protected

def configure_permitted_parameters
devise_parameter_sanitizer.permit(:sign_in, keys:[:username, :email, :encrypted_password,
:format])
end
end
```

Start with app/controllers/custom/api/devise_token_auth/sessions_controller.rb and the mounted API routes, then read DeviseTokenAuth::SessionsController alongside the Devise authentication_keys configuration. Reproduce sign-in through the API and website using the listed gem versions. Done means both paths authenticate with the intended username or email parameters without conflicting keys.

Written by the indexing model from the issue text.