To summarise there is an R package that allows users to enter their login credentials to access their Robinhood account. The user assigns a variable which is sent to Robinhood, Robinhood then sends back an Oauth2 token and a user id.
The user then uses this Oauth2 token to call various functions that can do things like view account details, fetch historical trading data, and place orders. All these functions essentially construct URL's or Headers to interact with the Robinhood API using either a POST or GET request. The token and uid are never encrypted or protected in anyway once the user makes a request to the Robinhood API.
Is this safe to use?
Follow up question, which is likely to specific. Is this safe to use in an R Shiny web application and hosted over the web?