Or we could just use our operating systems for the things we do well, and have a service to send our API calls to that inserts the appropriate token.

I don't have to enter my Mac's password every time I open an app.