UI routes

$router->get('/settings/api-tokens', [ApiTokenController::class, 'index']);
$router->post('/settings/api-tokens', [ApiTokenController::class, 'store']);
$router->post('/settings/api-tokens/{id}/revoke', [ApiTokenController::class, 'destroy']);

Token storage and validation

• ApiTokenService creates a random 64-hex token and stores a SHA-256 hash in api_tokens.token_hash.
• The raw token is shown once at creation time.
• ApiAuthMiddleware expects Authorization: Bearer <token>.
• Middleware checks expiration, updates last_used_at, and authenticates the user context.

Protected API routes

$router->group([
    'prefix' => '/api/v1',
    'middleware' => [ThrottleMiddleware::class, ApiAuthMiddleware::class],
], function ($router) {
    $router->get('/files', [ApiFileController::class, 'index']);
});