feat: add --api flag for Canvas API token authentication

- Add APIToken field to Credentials struct with omitempty JSON tag
- Implement GetAPIToken() method with persistent token storage
- Add SaveRefreshToken() helper to preserve API tokens during OAuth
- Implement --api CLI flag to use API token instead of OAuth
- Validate empty refresh tokens and skip refresh if invalid
- Update README with API token usage documentation

README.md

@@ -26,9 +26,14 @@ go build -o canvasarchiver ./cmd/canvasarchiver
    ./canvasarchiver -fo
    ```
 
-   Or for videos-only mode (all Panopto videos flat, no files):
+    Or for videos-only mode (all Panopto videos flat, no files):
+    ```bash
+    ./canvasarchiver -vo
+    ```
+
+   Or to use a manually generated Canvas API token:
    ```bash
-   ./canvasarchiver -vo
+   ./canvasarchiver --api
    ```
 
 2. On first run, you'll be prompted to authenticate:
@@ -53,6 +58,7 @@ go build -o canvasarchiver ./cmd/canvasarchiver
 | `-vo` | Videos only — scan recordings and all module video items, download everything flat into one directory; skips regular files |
 | `-me` | Download all enrolled courses |
 | `-n` | Prefix modules with order numbers `[1]`, `[2]`, etc. |
+| `--api` | Use a manually generated Canvas API token instead of OAuth |
 
 
 ## Configuration
@@ -68,6 +74,8 @@ The following constants can be modified in `internal/config/config.go`:
 
 Credentials are stored in `credentials.json` after the first successful login. The refresh token is automatically used for subsequent runs.
 
+With `--api`, enter a manually generated Canvas API token on first use. It is saved to `credentials.json` and reused on later `--api` runs.
+
 ## Notes
 
 - Files are organized to match Canvas structure

cmd/canvasarchiver/main.go

@@ -17,12 +17,19 @@ func main() {
 	videosOnly := flag.Bool("vo", false, "Videos only mode - download only Panopto videos to a single directory")
 	me := flag.Bool("me", false, "Download all enrolled courses")
 	moduleNumbers := flag.Bool("n", false, "Prefix modules with order numbers [1], [2], etc.")
+	apiToken := flag.Bool("api", false, "Use a manually generated Canvas API token instead of OAuth")
 	flag.Parse()
 
 	httpClient := &http.Client{}
 
 	authenticator := auth.NewAuthenticator(httpClient)
-	accessToken, err := authenticator.GetAccessToken()
+	var accessToken string
+	var err error
+	if *apiToken {
+		accessToken, err = authenticator.GetAPIToken()
+	} else {
+		accessToken, err = authenticator.GetAccessToken()
+	}
 	if err != nil {
 		fmt.Printf("Authentication failed: %v\n", err)
 		return

internal/auth/auth.go

@@ -32,6 +32,9 @@ func (a *Authenticator) GetAccessToken() (string, error) {
 	if err != nil {
 		return a.login()
 	}
+	if strings.TrimSpace(creds.RefreshToken) == "" {
+		return a.login()
+	}
 
 	fmt.Println("[*] Reusing saved refresh token...")
 	tr, err := a.doTokenRequest(url.Values{
@@ -49,6 +52,36 @@ func (a *Authenticator) GetAccessToken() (string, error) {
 	return tr.AccessToken, nil
 }
 
+func (a *Authenticator) GetAPIToken() (string, error) {
+	creds, err := LoadCredentials()
+	if err == nil && strings.TrimSpace(creds.APIToken) != "" {
+		fmt.Println("[*] Reusing saved API token...")
+		return strings.TrimSpace(creds.APIToken), nil
+	}
+	if err != nil {
+		creds = &models.Credentials{}
+	}
+
+	fmt.Print("Enter Canvas API token: ")
+	token, err := bufio.NewReader(os.Stdin).ReadString('\n')
+	if err != nil && err != io.EOF {
+		return "", err
+	}
+
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return "", fmt.Errorf("empty API token")
+	}
+
+	creds.APIToken = token
+	if err := SaveCredentials(creds); err != nil {
+		return "", err
+	}
+
+	fmt.Println("[+] API token saved.")
+	return token, nil
+}
+
 func (a *Authenticator) login() (string, error) {
 	codeVerifier, codeChallenge, err := generatePKCEPair()
 	if err != nil {
@@ -80,7 +113,9 @@ func (a *Authenticator) login() (string, error) {
 		return "", err
 	}
 
-	SaveCredentials(&models.Credentials{RefreshToken: tr.RefreshToken})
+	if err := SaveRefreshToken(tr.RefreshToken); err != nil {
+		return "", err
+	}
 	fmt.Println("[+] Login successful.")
 	return tr.AccessToken, nil
 }
@@ -162,9 +197,21 @@ func extractCode(input string) (string, error) {
 	return input, nil
 }
 
-func SaveCredentials(creds *models.Credentials) {
-	data, _ := json.MarshalIndent(creds, "", "  ")
-	os.WriteFile(config.CredsFile, data, 0o644)
+func SaveCredentials(creds *models.Credentials) error {
+	data, err := json.MarshalIndent(creds, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(config.CredsFile, data, 0o644)
+}
+
+func SaveRefreshToken(refreshToken string) error {
+	creds, err := LoadCredentials()
+	if err != nil {
+		creds = &models.Credentials{}
+	}
+	creds.RefreshToken = refreshToken
+	return SaveCredentials(creds)
 }
 
 func LoadCredentials() (*models.Credentials, error) {
@@ -173,6 +220,8 @@ func LoadCredentials() (*models.Credentials, error) {
 		return nil, err
 	}
 	var creds models.Credentials
-	json.Unmarshal(data, &creds)
+	if err := json.Unmarshal(data, &creds); err != nil {
+		return nil, err
+	}
 	return &creds, nil
 }

internal/models/models.go

@@ -1,7 +1,8 @@
 package models
 
 type Credentials struct {
-	RefreshToken string `json:"refresh_token"`
+	RefreshToken string `json:"refresh_token,omitempty"`
+	APIToken     string `json:"api_token,omitempty"`
 }
 
 type TokenResponse struct {