Maybe I'm answering my own question (I think?), but this looks like the way: https://developer.apple.com/documentation/musickit/using_musickit_to_integrate_with_apple_music

Some open questions: I assume MusicKit is doing 2 factor I'm not getting an error so I'm guessing identity is making it over?