[Remote Tool Integration] [JSON Tool] Token-based authentication to (1) NOT send user/name password in the clear and (2) make JSON Tool requests?

Hello Everyone!

I was looking at the JSON Tool[1][2] to potential push/data into my Joget instance. We have some legacy Excel Macro-based Workbooks people LOVE, some single page web apps, and even HTML Applications that would "work for our forms" (where as the Workflows within Joget are superb – and are forcing the old farts there!)...via the JSON tool.

Now: I know most of the planet is doing HTTPS ... but my Information Security guys would PANIC if they knew the password was being sent around in plaintext. Thus, is there a way to leverage a Token?

For example: I could iframe a login, add Bean Shell/leverage a plugin (maybe in [3]?) – which a user could go to a form to "request a token" ... which would generate a time-duration (e.g., a day, week, month) token ... that could be passed instead of a username/password.

(Unless something in [3] would allow something similar – I need authentication that a user is valid, while NOT sharing login information → to enable JSON Tool Push/pull of data)

I might be over thinking this, but any references/thoughts would help! (Note: if SSO works instead – that might be viable too!)

[1](JSON Tool)
[2](Sample JSON API Integration)
[3](JSON API)