How to competently authorize in the extension for GitLab?

Question

JavaScript

I want to write an extension for Chrome.
You need to get a list of Merge Requests and a list of Upvote for each of them.
But the first one needs an access token , and the second one needs a private token .

What methods and safe to get these tokens?

Answer 1

It turned out that authorization is not required.
You can just send requests.
The extension has access to the session.