> Harsh words Tom.
>
> The basic problem is that any product that uses the API must use
> PASSWORDACCESS PROMPT and come up with some method to encrypt the
> password locally so this it can be supplied this when asked by the api.

>From the 5.1 version of "Using the Application Program Interface":

Two methods of password processing are available: passwordaccess prompt, or
passwordaccess generate.

The second method, passwordaccess generate, encrypts and stores the password
value in a file. The node name and owner name cannot be supplied on the
dsmInitEx call, and the system default values will be used. This protects the
security of the password file. When the password expires, the generate
parameter creates a new one and updates the password file automatically.