Issue details

The API currently requires new "API client" to be created to operate, which includes a client_id and a client_secret.

But to actually work, the API also needs an access_token and refresh_token. And those are very short lived - one hour maximum.

This means to implement a client, you need to not only ask the user for an incomprehensible client_id and client_secret, but also for their username and password. Every client then needs to store those username and passwords indefinitely to regenerates the access tokens.

Environment

• wallabag version: 2.1.0 API documentation
• How did you install wallabag? irrelevant.
• Last wallabag version that did not exhibit the issue (if applicable): N/A
• php version: N/A
• OS: N/A
• type of hosting (shared or dedicated): N/A
• which storage system you choose at install (SQLite, MySQL/MariaDB or PostgreSQL): N/A

Steps to reproduce/test case

N/A.

Suggested solution

The username and password should be used only to create access tokens, which should be permanent. This would make the whole API way more efficient because then a single HTTP request would be require for API calls instead of two (assuming the worst case of less than one request per hour per client).

Alternatively, client tokens should be user-specific. I believe there may already be an issue about this, but right now, anyone can see (and delete?) anyone else's tokens on the server. That seems like a Real Bad Idea.

Clients should only ask the user's username and password as a transient secret, that can be used to create client tokens on the fly, which then can be used to create access tokens.