They've also started revoking previously valid tokens. I can no longer use RedReader with the API client I had created for this purpose.

The only winning move now is to start impersonating their app.