@Ryan Hellyer -There isn't a built-in token-handling method, as that's firmly plugin territory. However, the authentication system is (of course) pluggable (in fact, it uses WP's normal authentication, but with an additional handler for HTTP Basic authentication). I happen to have a plugin that does OAuth 1.1, so I might end up releasing a plugin to do this. :)

@David Gwyer - I happen to be working on a project for just that. ;)

Thanks to everyone for the kind words, and to Sarah for the interview!