Browser-only authorisation means there is no secret to paste into a config file, commit by accident, or forget to rotate. For a tool that touches store listings rather than production data that is a sensible trade — the cost is that headless use is not on the table. What we cannot tell you is the tool surface: the endpoint requires a session before it will say.
AppLaunchFlow's hosted endpoint for their App Store screenshot tooling. You connect once through a browser sign-in and the agent works against your account.
The screenshot workflow the product is built around. The endpoint answered a handshake but would not list its tools without a session, so what it offers is what AppLaunchFlow documents rather than what we counted.
OAuth 2.1 authorization-code with PKCE, done in the browser on first connect. There is no API key to store anywhere.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen