so for token based auth the customer that installs my bundle has to go to integrations and create a new integration and provide me with consumer key and consumer secret correct?