[0xferruccio]

I think the thing I really didn't like was the lack of an OAuth like flow with fine-grained permissions

Basically authentication with devices is "all-access" or "no-access". I would've liked it if a "write-only" or "add-only" api permission scope existed