Update 2018-07-09
This workaround no longer works as the oauth proxy’s API keys have been revoked. Unless you have your own API keys for Amazon Drive you can’t use it with rclone - sorry 
If you happen to know anyone who works at Amazon then please ask them to re-instate rclone into the Amazon Drive developer program - thanks!
I have developed an oauth proxy which stops rclone having to have encrypted secrets in its source code. The proxy server stores or logs no information and it runs on the very secure Google appengine platform.
I was hoping to use the new proxy server with a new set of official credentials from Amazon but none have been forthcoming yet.
However a very kind rclone user has run this proxy server with a set of his own credentials and allowed it to be used publicly.
I suggest you use this to get your data off ACD.
NB the following won’t work using rclone authorize you’ll have to use the copying the config file method if setting it up on a remote server. If configuring remotely you must use a new beta in both places. If you don’t it will work for an hour before giving you an error when it refreshes the token.
How to configure the proxy server
Updated to use easier config method recently added to rclone.
Firstly download the latest beta or make sure you are using version 1.37 or above.
Now run rclone config to make a new remote like this
No remotes found - make a new one
n) New remote
s) Set configuration password
q) Quit config
n/s/q> n
name> acd
Type of storage to configure.
Choose a number from below, or type in your own value
1 / Amazon Drive
\ "amazon cloud drive"
2 / Amazon S3 (also Dreamhost, Ceph, Minio)
\ "s3"
3 / Backblaze B2
\ "b2"
4 / Dropbox
\ "dropbox"
5 / Encrypt/Decrypt a remote
\ "crypt"
6 / FTP Connection
\ "ftp"
7 / Google Cloud Storage (this is not Google Drive)
\ "google cloud storage"
8 / Google Drive
\ "drive"
9 / Hubic
\ "hubic"
10 / Local Disk
\ "local"
11 / Microsoft OneDrive
\ "onedrive"
12 / Openstack Swift (Rackspace Cloud Files, Memset Memstore, OVH)
\ "swift"
13 / SSH/SFTP Connection
\ "sftp"
14 / Yandex Disk
\ "yandex"
Storage> 1
Amazon Application Client Id - required.
client_id> rclone
Amazon Application Client Secret - required.
client_secret> acd
Auth server URL - leave blank to use Amazon's.
auth_url> https://quixotic-module-170120.appspot.com/auth
Token server url - leave blank to use Amazon's.
token_url> https://quixotic-module-170120.appspot.com/token
Remote config
Make sure your Redirect URL is set to "http://127.0.0.1:53682/" in your custom config.
Use auto config?
* Say Y if not sure
* Say N if you are working on a remote or headless machine
y) Yes
n) No
y/n> y
If your browser doesn't open automatically go to the following link: http://127.0.0.1:53682/auth
Log in and authorize rclone for access
Waiting for code...
Got code
--------------------
[acd]
client_id = rclone
client_secret = acd
auth_url = https://quixotic-module-170120.appspot.com/auth
token_url = https://quixotic-module-170120.appspot.com/token
token = XXXX
--------------------
y) Yes this is OK
e) Edit this remote
d) Delete this remote
y/e/d> y
Now test it is working with rclone lsd acd:.
But it sure would be nice to know that the proxy hasn’t been tampered with. I guess you have to trust someone at some point! 