TL;DR

You are required to install a request interceptor browser extension such as Requestly before using this app.
Skip to the Recommended solution section for more info.

Context

At this time, Moneytor being a pretty small project, it is not a priority to have a fully fledged user system, as backend hosting services are not free. This implies that all the data displayed on the website is fetched by the client from the Wakatime API directly, and is not stored on any third party server.

However, such an architecture has some drawbacks, one of them being that Wakatime does not authorize CORS requests, and therefore blocks all requests whose origin is not registered on their side.

Existing options

I have tried solving this issue in the cleanest way possible, and believe me, the lack of effort on my side is not the issue here.

Setting up OAuth2 on a backendless architecture, as recommended by the official Wakatime documentation is both stupid and pointless, since it would require the app to store sensitive data (such as the app secret) on the client side, which poses a huge security risk. I still did try to implement such a solution, but it appears as if requesting a refresh token is not possible from a browser, so I had to give up on this idea.

Another approach would be to use the Wakatime API key, usually provided to IDE plugins such as vscode-wakatime. While this does indeed simplify the process of authenticating the user, it does not solve the CORS issue, which again cannot be solved by the client side.

Recommended solution

A reliable, though not very elegant solution is to intercept and modify all requests made by the client to the Wakatime API, and add the required headers to them. This can be achieved by using a browser extension such as Requestly. The recommended configuration is available here

It is absolutely necessary that you do enable this extension before accessing the app, as you will not be able to authenticate otherwise.

Fixes

No fixes are planned for this issue for the time being. I might reconsider this decision in the future, but for now, I am not willing to spend any money on hosting services for this project.