auth requirements

hi there,

I am implementing a wallabag compatible server (here: [sako](https://sr.ht/~sbinet/sako/)).
It's working rather well (if I may say so myself), and the wallabag web extension works well when directed at the `sako` based endpoint.

when trying to use the android-app, I have had to inject mysterious strings inside the HTML landing page:
- https://git.sr.ht/~sbinet/sako/commit/3253f8b20458b491775cd9896bb6a16d9e1d8159

(could this be documented somewhere ? I was a bit surprised by this mix of scraping HTML and using the REST API)

with that "hack", I could make `android-app` properly (or seemingly) authenticate with my `sako` server, retrieve articles into the `android-app` cache, and generally use that app.
however, it seems renewing the credentials doesn't work even though it does seem to work for the wallabag extension + sako (where I believe I did correctly implement the `/oauth` endpoint).

so, here is my question: how is the renewal of credentials supposed to work, and what `sako` needs to provide for `android-app` to work properly ?