You can use either your password or your API Token. It only stores your API Token which you can revoke at any time. If a user enters their password, it'll just interchange it for an API Token. You can check this out here https://github.com/jpadilla/feedleap/blob/master/apps/auth/f...