They are an oauth provider, and provide a file with client ID + secret + endpoints, which you dance to exchange for a 1-hour-scoped session token which needs to be included on all operations