Revocation reaches the apps within a minute (each app caches a sign-in check for sixty seconds).
Tell them the first password; they can change it on their account page.
A service token acts as its owner for scripts and tools (Authorization: Bearer) and never writes a record. It is shown once.
On the box, register-app.sh does this and writes the app's data/admin-auth.json. A secret is shown once.
build