All OAuth tokens, even the official ones, are leaked at this point. Google them.