How to safely pass an api token to an authorized user for a browser extension?

Question

API

It is necessary to pass the user token for the api to the browser extension if it is authorized on the site.
How to do it safely?
It turns out that we open it possible from any domain to send us requests and a "hacker" can send requests to our site on his site and receive a user token (if he is authorized on our site), thereby gaining full access to the user's data.

Answer 1

1. One
2. Two