Shakha is a headless authentication broker gem for Rails that handles Google OAuth 2.0 with PKCE security. It provides domain-scoped user identifiers via pairwise subjects, ensuring the same Google account gets different IDs across different applications. Built DHH-style: database sessions (no Redis), Turbo native (zero JS), and a single "Continue with Google" button. Works as an embedded Rails engine or standalone service.