They mention that this token is temporary and a permanent one can be acquired by hitting another endpoint on plex.tv with the username and password. I don't really want to collect this data, and I'm pretty sure it won't be able to do this from the client due to CORS.
Response includes XML objects that include a key property. This can be added to the hostname to access the media file.
So basically it works, but setting up the authentication is either temporary or annoying. Also the token would be exposed to everyone in the room (which might be OK).
Did some investigation on this.
Plex generally requires authentication on servers. It's possible to disable this but probably not something that server owners will want to do.
Getting a token: https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/
They mention that this token is temporary and a permanent one can be acquired by hitting another endpoint on plex.tv with the username and password. I don't really want to collect this data, and I'm pretty sure it won't be able to do this from the client due to CORS.
The Plex server appears to fetch the token from: https://plex.tv/api/v2/user?includeSubscriptions=1&includeProviders=1&includeSettings=1&includeSharedSettings=1&X-Plex-Product=Plex%20Web&X-Plex-Version=4.30.2&X-Plex-Client-Identifier=mi9xvzn239bdvmsugn2pnvy5&X-Plex-Platform=Chrome&X-Plex-Platform-Version=81.0&X-Plex-Sync-Version=2&X-Plex-Features=external-media%2Cindirect-media&X-Plex-Model=bundled&X-Plex-Device=Windows&X-Plex-Device-Name=Chrome&X-Plex-Device-Screen-Resolution=939x858%2C1500x1000&X-Plex-Language=en&X-Plex-Token=h4sWiBS-nQPMWeZxyhxf
Using the token: Hit this endpoint: http://127.0.0.1:32400/library/sections/1/all?X-Plex-Token=h4sWiBS-nQPMWeZxyhxf
Response includes XML objects that include a key property. This can be added to the hostname to access the media file.
So basically it works, but setting up the authentication is either temporary or annoying. Also the token would be exposed to everyone in the room (which might be OK).