I’m sure there’s a way to have an extension that doesn’t need the user to go through the normal authentication flow, as I’ve seen extensions that immediately recognize that the user is authenticated, and it proceeds to make private api calls.