A-ha! Thanks for the reply - you replied to my comment on Hacker News earlier. 
I ended up going with the phx.gen.auth generator and basically ripping sessions out, while keeping token generation for API authentication. The server just returns a base64 encode of the binary bytes generated as token on the server. On the client, I use next-auth to store the session token and user. It’s surprisingly elegant and I’m happy with it.
I tried Guardian but the implementation was a little messy and the generator was much cleaner. I also found Pow just wasn’t great for API use, too many open ends when it comes to things like email confirmation and whatnot.
This is my boilerplate so far, with the above customizations: GitHub - matteing/stack: My stack for new products. · GitHub
Here is the Plug where I ripped out sessions and tied everything together: https://github.com/matteing/elixir-boilerplate-testground/blob/main/lib/useindie_web/auth.ex
Here is the auth token creation function, with the added encoding step: https://github.com/matteing/elixir-boilerplate-testground/blob/main/lib/useindie/auth/user_token.ex#L29
I hope my repository serves as a starting point for others looking to retrofit the auth generator for APIs! I managed to do it with a good degree of success.
