Credentials stored in plain text.

Given the commodity of privacy and security breaches these days, I would imagine this to be an extremely import requirement for the extension.

The lack of this is concerning, and begs the question if the same negligence for secret management is practiced in other services/software as well?

There is the requirement for a Client Id and Client Secret, why is this not enough to authenticate the client? The necessity for a Username and Password defeats the purpose of having client specific tokens, no?