It used the browser agent to grab user cookies after signing in, then made API calls iirc.

Using just a browser is way too token intensive and slow. It would look for 401 errors then run the browser automation to login with the credentials and grab the token.