In two legged oauth the Token is not required but the key and secret are. We already validate on the key and secret and sign data with the secret, generating another token from those credentials would not do anything for us. However, if we provide 3 legged oauth at some point, the token could come from a provisioner that clients have to register with. That in addition to what we have would be good. So the machines submitting data would be identified by a 3-legged oauth protocol, and would be given unique tokens identifying them, that would give us the control to expire tokens for individual clients. The client would still require a repository's credentials to submit data. Best of both worlds...