Make serialisable
Setup the app key when we setup the sec engine
Use APITokens for auto auth as can be revoked