Don't overthink the token. At its very basic level, it's little more than a server generated proxy for username and password, often with a time expiry and access rights.

So you login using username/password, the server then generates the token normally with a date validity range and set of capabilities that you can undertake - such as what version of Tidal you can use. From then on, you perform your requests using the token (it doesn't matter where from, it's long/complex enough to include anti spoofing checks) and all the while that token is valid for the request that you make, you get that service.

At some point, that token will time expire (it may even be rescinded), at which point, often transparently to the user, a new token will be generated using username/password. It's much more efficient to pass a token around with every operation than to keep logging in.

Meridian owner since 1992
Prime & PSU, Focal Elear headphones, Roon (ROCK 8Gi5 NUC), Explorer 1 & 2, F80. 200/203, various Sonos (via Roon).