In reply to Timothy Jacobs.

Hello Timothy,

Thanks, I did read that but did not look further into it until you mentioned it.

I see this is user specific, which in the scheme of things is a good idea. What would be cool is to have a 2nd password, where the one you see today is only for refreshing a password (like a refresh token in oAuth2), and also a 3rd password that acts as the client secret. I guess what I would like to see is true oAuth2.

If there was a way to issue client ID’s and secrets via an API, you would be able to revoke clients and it would also allow any user to the blog to authenticate with the client, in theory. The site may want to limit client access to specific users like your doing now. Very complicated.

Thanks,
Angelo