Using multisite for a ReSTful API and Auth Strategy
This can certainly be achieved without any multisite. Meaning you could always house the API on the same site and proxy the path api.mysite.com to mysite.com/api thus allowing it to be invisible to the user. (Make sure your webhost supports mod_proxy or you have some external proxy you can use for this task)

As for the actual authentication, I don't bother with tokens. Use credentials. This way people can get and keep a session (in line with however long you want them to based on session_lifetime in your settings.php) - After an initial call to a log in path, they can then subsequently call the API over and over again by passing the unique session they are assigned.

Go with the single site approach and use web proxy magic to make it look like a different domain. Easy enough.