I’m writing a “watcher” that is actually a manual log of analog events. This is how I see my app using activity watch.
To segregate external watchers, they should submit a human-friendly name to the server and receive a token, i.e. a UUID or hash. Every time my watcher sends an event to the server it will include the token. I should be allowed to read events created with that token, or even if it was write only that would still be okay. So each watcher should have a token and later work can add better authentication for reading watcher data. The token name doesn’t even need to be unique, it’s just for display purposes.
I see the AW server as a place where apps can log events that the user may be interested in for tracking themselves in a fundamentally private way. It promotes digital well being and maybe just plain well being. Having watchers use tokens lets apps easily write events and leaves room for AW features to manage read access or limiting writes. Each internal watcher could use a dynamic token as well (per install).
This is a lighter alternative to the authentication measures in issue 32 and adds weight to feature 37.
As an aside, the manual events have more timestamp properties like a start and an end. That would just be in the extra field on the db table (haven’t checked schema in a while) or held externally – no need for changes but start/end times might be useful on events.