Yes, the clamshell app will have to know the key. 

Agreed that permissions should go along with the token; the token request can include desired permissions, and we can store those with the token. 

In the work I'm about to do to move the tokens into a database, I'll include a permissions model.

For now, I'm going to merge this one.