I think it should be entirely oauth. no password needed