tbh I don’t know! I’m certainly not aware of an endpoint that will give you the API key, and my feeling is that the industry standard Oauth flow is the expected route to achieve authorization without the user copying/pasting.
Not sure if you saw this, but it might be useful: Websocket rate limit exceeded