currently I face the issue that I am building a modular Application that can run 3rd party Scripts within the interface, my concern now is that they grab the token and send over the Tab requests to the Server to steal Userdata. I had 3 Solutions in mind but I don't know if any of them is good, or if you maybe have a different Solution.

1. I put the entire App within an Iframe and set it to sandbox mode. The issue with this might be performance, Code difficulties and my App needs an Iframe anyways, so I would have at the end an Iframe nested within an Iframe.
2. I could generate a Token only for the editor, so for example that you have a specialized Token that can be used only for a few actions, and so by that, a bad code could not really do damage since they lack permissions.
3. (The approach I would prefer to do) I somehow store the token in a way that you cannot access it, but that prerendered functions can use it to interact with the server.

So any ideas on how I could do this?