18 ms·

Yep, the OBP approach is to use OAuth (currently 1.0a) so the App doesn't have to see the credentials.