The web app probably authenticates using an API as well, in which case it's trivial to add that to your shadow client as long as you have the credentials.