Holger,
The authentication mechanism is Oauth2 and not really an issue.
The main problem is the API will push data once and once only, it assumes it is communicating with another website and data store.
Notifications are sent to the website that data is ready to pull and then the data is requested via a pull to sync.
It is not possible to query or request data on demand- a feature needed by mobile apps or desktop apps like GoldenCheetah.
Mark