Haven't fully read or grokked this yet, but it seems to me that this might be better suited as OAuth.config rather than Accounts.config, as I should be able to use it for apps that don't use accounts?

I also think it would be worth mentioning how you get the unencrypted tokens for use? I have tokens stored in a couple of different collections, so would like to see an explanation (code samples?) on how I seal and open them for use in those collections too.