The author does acrobatics with sourcing the temporary file and then backslashing the dollar in the heredoc when all he needed to do was backslash The dollar in the in the first place. The author shows a new script with double quotes instead of a heredoc that would lead to the exact same result. He starts with `export AUTH_TOKEN=$APP_AUTH_TOKEN` but then later he said he was working with `export AUTH_TOKEN=$AUTH_TOKEN`.
Heredocs work fine. If the author had written this originally and `$APP_AUTH_TOKEN` we're indeed set on the originating machine, then the original heredoc would work just fine.
This whole article leaves me feeling very confused.