Hacker News Reader

It's what git-annex does too. In fact, it does a bit more: rather than launching the browser directly to that URL, it generates an HTML file that then redirects the browser to the URL. That prevents other users in the same system from discovering the token by looking at the process arguments.

The Parity cli (Parity is a Proof-of-Authority Ethereum testnet) does exactly this:

https://github.com/paritytech/parity

This is not quite right - Parity is an EVM implementation, and supports the PoW Foundation chain, amongst other configurations like PoA.

You could to that in the server level (not the app level); e.g. in the .htaccess file for apache users.

Isn't it enough just to have the app require a certain user agent?

That would still be an authentication token, just placed somewhere else in the request.