Thank you! That's a wealth of information.
Unfortunately for me I'm using an application (java) that is using a jxbrowser (embedded browser) so native authentication like sharepoint etc don't work. The user is prompted as if in incognito.
The other feedback is great too.
I'll leave this question open because I'm still wanting to know about using the API bearer token to load the report in some way. If I don't get an answer I'll mark yours as accepted as it's the best I've got in multiple forums so far.