桌面版Evernote SDK能否使用账号密码替代Token实现鉴权？

Hey there! Let me walk you through this clearly, since I’ve worked with Evernote’s SDKs for desktop apps similar to Web Clipper before.

First off: Evernote no longer supports direct email/password authentication in any of its current SDKs—desktop included. This isn’t just a "production-only" restriction; even for testing, the official SDKs have removed all password-based auth endpoints, and Evernote’s API servers will reject any requests trying to use this method. The core reason is security: passing plaintext passwords (even over HTTPS) carries far more risk than short-lived, revocable OAuth tokens.

That said, for a Web Clipper-style desktop app, you don’t need password auth to get the smooth user experience you’re aiming for. Here’s what you should do instead:

• Use OAuth 2.0 Authorization Code Flow with a built-in browser window (think Electron’s BrowserWindow, Qt’s QWebEngineView, or whatever your framework offers). This lets users log into their Evernote account directly through Evernote’s official login page, so you never handle their password at all.
• You’ll get an access token (for immediate API calls) and a refresh token (to automatically get new access tokens without prompting the user again). This flows just as seamlessly as password-based login for your users.
• This method is fully supported in production—no restrictions here. It’s exactly how Evernote’s own official Web Clipper works.

A quick note: If you’re looking at older SDK documentation that mentions password auth, that’s legacy functionality that’s been sunset. Those endpoints are dead, so even if you dig up an old SDK version, it won’t work with Evernote’s current API servers.

Stick with OAuth 2.0—it’s secure, compliant, and the only supported path forward for Evernote integrations now.

内容的提问来源于stack exchange，提问作者Kamil Gareev