Isn't this what the centralauthtoken is for?

The status quo is that when you first log in (even if you autologin, ie. visit a wiki where you were not logged in while having a valid global session), CentralAuth creates accounts and logs you in on all English wikis and all multilingual wikis (including Commons and Wikidata). This is considered a bug (T18864). There is a security argument that autologin should not happen at all (T21161). The same account creation does not seem to happen on registration itself, so if a user registers on enwiki and never goes to any other site, they won't have Commons/Wikidata accounts.

We can use $wgCentralAuthAutoCreateWikis to make sure accounts on wikis always exist, but this does not really help as CORS API request will still fail (? I think so but haven't tested) because the user does not have a session cookie for the second-level domain belonging to that site.

In T103958#1403592, @Legoktm wrote:

Isn't this what the centralauthtoken is for?

Huh, forgot about that completely. Does it autocreate the user if needed? It seems like it would. If that's the case then the only thing needed is to make sure people can find out about it easier and maybe provide a JS library to make it less annoying to gadget writers, something along the lines of mw.Api.postWithToken. (And maybe not change it after every request? That seems a bit awkward.)

Yes, it does autocreate if necessary.

I wonder if anything became of Brion's proxying suggestion? From a client standpoint it seems much more convenient.

Added some documentation to https://www.mediawiki.org/wiki/Extension:CentralAuth/API

In T103958#1405892, @Tgr wrote:

the only thing needed is to make sure people can find out about it easier and maybe provide a JS library to make it less annoying to gadget writers, something along the lines of mw.Api.postWithToken.

T66636 would probably fulfull that role.

The distinction between this report and T104932 seems quite thin.

In T103958#1462404, @Nemo_bis wrote:

The distinction between this report and T104932 seems quite thin.

This is about API requests, that one is about Special:OAuth.

See also T149672: OAuth: don't abort if the username does not exist on project which is the same issue for OAuth.