The OAuth token is also stored in plain text on the device. This is by itself enough to locate, track and unlock the car. The app prompts the user for the username/password in order to start the car.

Mandatory disclaimer: I'm affiliated with Promon.