Obtain a Music User Token via MusicKit JS or MusicKit on Apple platforms and use it alongside a developer token to read a signed-in user's Apple Music library

Steps

1. Generate a developer token (ES256 JWT signed with your MusicKit private key, using your Team ID, Key ID, and a Music ID identifier) and keep it server-side or short-lived on the client
2. Initialize MusicKit (MusicKit JS on web, or the MusicKit framework on iOS/macOS) with the developer token and call the authorize flow, which prompts the user to sign in and grants a Music User Token
3. Store the Music User Token client-side (it is a user-scoped credential separate from the developer token, and is not something your backend should hold long-term)
4. Send requests to Apple Music API endpoints under the library/ path (e.g. a user's library songs, albums, playlists) with both an `Authorization: Bearer <developer-token>` header and a `Music-User-Token` header
5. Use the same pair of headers to modify the library where permitted (e.g. adding catalog resources to the user's library) — read the relationship/attribute docs for each resource since not all library objects are writable the same way
6. Handle Music User Token expiry/revocation by re-invoking the authorization flow rather than assuming the token is permanent