It would be good if we could define multiple rest client id/secrets. They are like api keys that we could assign to apps that are permitted to connect, instead of sharing a single client id/secret with all app writers.
Ideally, the list of client id/secrets would be editable through the backend admin portal.
This could be combined with #57 so that you could define the rest endpoints accessible based on the client id.