• Add API access authentication
• Should confirm for a JWT token on certain request parameters:
  • Headers: headers['x-session-token'] = <token>
  • Query String: ?token=<token>
• The JWT should be stored with a expiration time on the Sessions table
• Upon logout the Session row corresponding with the current logged in session.id should be invalidated

Github and Spotify do not.

I believe the following functions are sufficiently general that they can be pulled into the Strategies module directly:

client/1
has_client?/1
set_client/2
set_client/4
del_client/1

Yeah, probably needs some tests

/api/services/:service/app?id=:id&secret=:secret most likely.

A dumb cache probably won't end up cutting it -- some data changes very often and other doesn't. In reality, we're going to have to understand the api anyway -- a proxy isn't sufficient for our goals.

Currently we rely on the user pasting the code into the console, which is clearly wrong.

Still learning elixir conventions, but function, variable, etc should be in snake_case rather than camelCase.

And Sources to Source

Either use /api/services (get all authorization urls for services we don't have credentials for) or /api/services/:service. I lean toward the latter, just because it feels asymptotically more correct, but they're essentially equivalent.