That's right, credentials are send to the API, then we generate a personal token (you can see it in your settings).

I will push sources at the end of the month or in the first half of march.