EasyRackOpenID. Simplifies OpenID login for Rack apps. Get Rack::OpenID of http://github.com/josh/rack-openid gem install rack-openid You: require 'rack/openid' use Rack::Session::Cookie use Rack::OpenID use EasyRackOpenID, :allowed_identifiers => ['http://example.com/'] run lambda {|env| [ 200, { 'Content-Type' => 'text/plain' }, [ 'Authenticated!' ] ] } Basically, slap EasyRackOpenID in front of the App you want to protect. Rack::OpenID needs to be above it. Rack:OpenID with noo arguments uses an in memory OpenID store. This is ok for trying out with rackup, but won't work in a variety of scenarios including using shotgun. You can pass it a different store like so: use Rack::OpenID, OpenID::Store::Memcache.new :allowed_identifiers is required for EasyRackOpenID to work. Give it an array of all the OpenIDs that you don't mind proceeding. :default_return_to (optional) is a path just in case the automatic return_to mysteriously vanishes. Unlikely. :login_path (optional) is where to send a user if login fails. Perhaps a login form? :logout_path (optional, defaults to /logout) path that, when visited will clear the login session :after_logout_path (optional) After a user logs out, send them here. (don't want the user sitting on the logout path)