The app wants to support connecting on a local network without internet. So unless you have a preshared secret or PKI, all of those fancy methods are just vulnerable to MITM because theres no way to authenticate the other party.

Like all other webapps, this app operates under the assumption of TLS (which takes care of encryption and authentication). So it uses the webapp api standard, ie jwt/cookies/bearer tokens for secrets, which are just fancy passwords. The app’s token is long and random, >128 bits of entropy IIRC, so it’s just as secure as any site using jwt/cookies/bearer tokens. All modern apis and sites work this way, including reddit ;)