Mints tokens via bi-api /auth/token using the studio_api_secret as X-API-Key, then loads the extensionless bundle inside an iframe and hands the config over postMessage. Used only locally; the Angular portal supplies this object in production.
bi-api /auth/token
studio_api_secret
X-API-Key
postMessage
The studio_api_secret is the value of the Looker user attribute of the same name. It's kept only in localStorage and never committed. The Angular portal will call this same endpoint in production.
localStorage
sub
Skip the mint step and use tokens you already have (e.g. copied from another portal's devtools).