I think these are actually two different questions. One is asking about new auth APIs so you don't need to run a script to connect accounts. We're working on th

I think these are actually two different questions. One is asking about new auth APIs so you don't need to run a script to connect accounts. We're working on that! The second is about how to do API authentication, i.e. how API requests are secured. The sync engine just provides all API data as a service, namespaces by account ID. Developers need to "secure" this by either running it behind a VPN, adding a proxy layer like Nginx, wrapping API calls in their own application layer, or dozens of other solutions. Everyone does this differently so it doesn't make sense to include as part of the default sync engine. The simplest version is probably to just block access to `/accounts` for external users and treat those account ids as authentication secrets. (They're just opaque long strings.) We're not against contributions, and nobody has actually built an auth system and submitted a PR.