Summary
Netatmo smart radiator valves (NRV), thermostats (NATherm1) and their relay report to the Netatmo cloud only: there is no local API. This template polls the Netatmo Energy API from the broker, publishes every room into a Unified Namespace, and lets an operator change a room's setpoint from the UNS.
The whole OAuth 2 refresh-token rotation runs inside the Coreflux broker: no container, no cron script, no token in a file. A REST Route posts the refresh, an action keeps the rotated pair in the broker's encrypted secret store, and the Route reads the tokens again per request. They never travel from a client and never sit in your git repository.
It is the pattern we run against a live Netatmo account, generalised and hardened by what operating it taught us. Two of its rules came from failures: the refresh must never land in the same second as a poll, and the token store must only ever write a real token pair.