I want to be able to insert records into a custom object on behalf of users from my web app without their direct involvement aside from their initial granting my app permission to do so. The events that will trigger these inserts could happen at any time (not necessarily when the user is logged into my app).
So, I plan to ask the users of my app to create a remote app in their Salesforce environment and then provide me with the Consumer Key and Secret. Then, have them "authorize" my app which should make an auth request to Salesforce and return an auth token or a refresh token that I assume I can store in my db for later use? I realize I could just ask them to provide me with their Salesforce username and password directly, but I'm also aware this is bad security practice.
Am I missing anything? Will I be able to reuse the refresh token ad infinitum even after the user of my app has ended their session, etc?
My app is written in PHP.