non-password tokens for auth/auth

Posted on behalf of Ricardo Signes. Original posting date 2014-01-17

We have written a few tools to interact with the LiquidPlanner API. The biggest problem we've faced is the fact that authentication and authorization require the password for each user. A single web service, for example, can't take any action on behalf of a user for whom it does not have a stored password. I'd much rather if users could provide app-specific tokens, preferably both read-only and read-write. OAuth2 would be nice, but even simple tokens would be a huge improvement.