Thin Rails engine for personal API keys: issue a raw token once, store a SHA-256 digest, soft-revoke, and authenticate ActionController::API requests with Authorization: Bearer. Host apps own UI, routes, and domain APIs.