I mentioned Identity in my first comment. I've never found it as simple as Devise though - especially in an API only setting.

With Devise there's a third-party Gem you can use called devise_token_auth which deals with everything automatically.

https://github.com/lynndylanhurley/devise_token_auth