As another HNer responded: cred screens are given the appearance of being your financial institution, so I assumed an api auth token being issued after “logging in” with the institution. Still, shame on me for not inspecting more closely.