We also need to be careful to avoid (if at all possible) triggering this from hooks, etc. in the future, if it could cause side effects.

Also when using bot passwords.

In T140963#2482650, @Tgr wrote:

Also when using bot passwords.

Thanks, added.

The centralauthtoken API will record a token in the central session data and use that to authenticate requests. The only way to access the central session data is via the session ID (to be more specific the session cookie contains a key which addresses the local session data, and that data includes the address of the central session data), so it cannot be done on an OAuth request (or any other request with a nonstandard authentication mechanism such as bot passwords, centralauthtoken, or some other session provider in use on some third-party wiki).

The token could be stored under a key that's computed from the user name or ID in a deterministic fashion; then it could be set up regardless of how the current request was authenticated. Not sure what the security implications of that would be. (The handling of requests from different sessions belonging to the same user would also require some thought.)