As a browser extension, this is very possible to do securely (we support it for our extension pixiebrix.com):

1. APIs accessed authenticated via OAuth2, or via locally-managed credentials. (Browser extensions support this via https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...)

2. For data extraction and form fill, the data never leaves the user's browser