> Have an app where user logs in through said website, then scrape their friends using this user's token.

That's some extremely shady thing to do.