The API doesn't know how the token was obtained, it just knows that it doesn't work for the current user. In this particular case, that's because passing the 'callback' parameter forces the request to be treated as if the user is not logged in.

While ApiSandbox could detect if the 'callback' parameter is set, I'm a bit wary of that solution since turning it on and off could result in some confusing behavior. It's also possible that other parameters could result in the same effect, for example specifying a value of '*' for 'origin'.

I think I'd rather have the API somehow signal when $main->lacksSameOriginSecurity() causes the request to be handled as logged-out, and have ApiSandbox display a general warning whenever that signal is present.

Change 354646 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/core@master] ApiSandbox: Indiciate when login is suppressed

https://gerrit.wikimedia.org/r/354646

Change 354646 merged by jenkins-bot:
[mediawiki/core@master] ApiSandbox: Indicate when login is suppressed

https://gerrit.wikimedia.org/r/354646

The resolution here is to have the results page clearly indicate that the request was processed as a logged-out user and that the automatic token handling does not work in that case. The result will still, however, display the badtoken error since a bad token was indeed submitted.