The token you get from onAuthorised is a JWT and its not applicable for making calls to Kraken/Helix.
The JWT is only used to validate that the user_id contained within it is the user_id that it claims to represent. And additionally when passed from your extension front end to your backend validates it is coming from the front end.
Simply speaking you don’t
What API calls do you intend to make that requires authentication?