I need to add a Today Widget/extension to an existing iOS app, which requires the user to sign in via a `WKWebView`.

As the extension only communicates with Apple frameworks or via `openURL()` back to the main app, how would I best share the authentication token stored in the main app with the Today Widget/extension, so that it can make authenticated API calls?

Can this be done with a shared keychain? Or is there another secure alternative?

It is not feasible to have the user sign in again in the Today extension UI.