API/service authorization layer

A lot of crypto here.