I think these are actually two different questions. One is asking about new auth APIs so you don&#x27;t need to run a script to connect accounts. We&#x27;re working on that!<p>The second is about how to do API authentication, i.e. how API requests are secured. The sync engine just provides all API data as a service, namespaces by account ID. Developers need to &quot;secure&quot; this by either running it behind a VPN, adding a proxy layer like Nginx, wrapping API calls in their own application layer, or dozens of other solutions. Everyone does this differently so it doesn&#x27;t make sense to include as part of the default sync engine.<p>The simplest version is probably to just block access to `&#x2F;accounts` for external users and treat those account ids as authentication secrets. (They&#x27;re just opaque long strings.)<p>We&#x27;re not against contributions, and nobody has actually built an auth system and submitted a PR.