Yes, that's what I'm thinking: only the token is needed. Will the gem be strong enough to implement my example ? I mean the OTA part ( generate code and authorized with devise gem )?