better authenticarion

README.md

@@ -30,9 +30,26 @@ cp .env.example .env
 ```
 
 Add the client ID and secret for the Netatmo application **GetNetatmoData v2**
-and a refresh token to `.env`. Netatmo's OAuth authorization step must be used to
-obtain the initial refresh token with the `read_station` scope. Secrets are read
-from environment variables and are never stored in an RRD.
+to `.env`. Ensure `NETATMO_REDIRECT_URI` exactly matches a redirect URI configured
+for that application, then perform the initial `read_station` authorization:
+
+```sh
+set -a
+. ./.env
+set +a
+.venv/bin/python scripts/get_netatmo_token.py
+```
+
+The helper opens Netatmo's consent page. After approval, paste the complete URL
+from the browser's address bar back into the prompt. This works even if the local
+callback page itself cannot be reached. The script exchanges the authorization
+code and writes the token file with mode `0600`.
+
+The service loads `NETATMO_TOKEN_FILE` at startup. Before an access token expires,
+it refreshes it and atomically saves both the new access token and any rotated
+refresh token. Values in the token file take precedence over initial token values
+in `.env`. Client credentials remain environment-only and are never written to
+the token file or an RRD.
 
 Export the file and run Flask:
 
@@ -53,6 +70,9 @@ scheduler runs inside the service process. Alternatively set
 
 `RRD_FOLDER` configures the database directory (default `./rrd`). The module
 variables in `.env.example` allow the five Netatmo display names to be changed.
+Set `URL_PREFIX=/w` to mount the dashboard, static assets, and every API endpoint
+below `/w`; leave it empty to serve from the site root. When a prefix is set,
+open <http://localhost:5000/w/> instead.
 
 ## HTTP API