For MVP this token is shared with the Zotero plugin. OAuth can be added later behind the same API contract.