oAuth 2.0 and API V3.0 general questions

Hello David and team at CC.  It's been a while.

We are currently wanting to upgrade our CC integration in our product from API V1.0 to API V3.0.  In reviewing the requirements, it appears many things have changed.  

To review, our product is a desktop app written in vs.net that gets installed at our customer's location.

First, it appears that they (our customers) will no longer use their CC login name and password to access to their data.  Rather each customer would have to generate and input their own specific api key and secret key.  Is this correct?

Second, it appears that requests and responses formatted in Xml are no longer supported.  Is this correct?

Thanks.