quacamole javascript client http tunnel getting connected - guacamole

Question

Guacamole 1.2.0
I have a running guac server and I want to create a client connection from another web app on different domain(for testing) and move to the same domain once production ready. I've tried HTTPTunnel and the websockettunnel, both of failing for different reasons. Websocket seems to only want to connect to itself on localhost even if I supply the full URL of the guac server and HTTP tunnel I'm getting a CORS error about InvalidAllowCredentials. The following are two variations I've tried and the rest of the html is from the example on guac doc site.
var guac = new Guacamole.Client(
new Guacamole.HTTPTunnel("https://example.com/tunnel", true)
{#new Guacamole.WebSocketTunnel("https://example.com/websocket-tunnel", true)#}
);
If this connect was going to work I believe I'm missing configuration and authentication information.
The guac documentation seems to be lacking and I'm not sure what I should be doing.
What needs to be done to get connected to an existing machine?
Example.
API call, authenticate user and get a token.
API call, search for connection
Create tunnel, pass in connection somehow
Client connect
This should pop up the display to the remote machine.
Headers added in nginx config under the location / section
add_header 'Access-Control-Allow-Origin' 'http://127.0.0.1:8000' always;
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,ContentType,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;

Answer 1

You may check how a connection is made in the guacamole client application, in the file ManagedClient.js. Search for functions getInstance() and getConnectString().
In principle, you are correct about the token, you can get one with this API call:
curl 'https://guacamole.example.com/guacamole/api/tokens' -H 'Content-Type: application/x-www-form-urlencoded' --data-raw 'username=guacadmin&password=somePassword'
The un/pw are for Guacamole, not for the remote machine.
Once you have the token, you may create HTTPTunnel and Client, populate parameters like shown in getConnectString() and initiate connect(). Keep in mind that the credentials for the remote machine are set up on the Guacamole side. In the getConnectString(), you are only selecting one of the connections defined on the Guacamole server.
Note that depending on the actual plugin used for authentication, different data may be sent; you can also make your own auth plugin with completely different authentication or make a plugin where remote machine credentials are sent directly from JS code. Several example auth plugins in the extensions directory; the above assumes you are using the default database auth plugin or file auth plugin.