Adding new actions to YOURLS API : a thing to ponder

Adding new actions to YOURLS API : a thing to ponder

Currently the set of action available in the API is voluntarily limited to a few "non destructive" actions (no editing or deleting) because there's a passwordless way of doing things (signature token or signature token + time hash, see wiki page http://code.google.com/p/yourls/wiki/PasswordlessAPI)

I think passwordless destructive actions might be a little too dangerous to allow : no big deal if someone steals your signature token to add spam links, but pain in the ass if it's used to modify or delete all your links

Options :

- require login + pwd for destructive actions ? might be a bit limiting

- adding a new "super power" signature token that would be more secret, once/if there is a proper user & privileges management in YOURLS

- maybe another option to consider is having a YOURLS plugin that will register custom API actions