After much time spent researching and trying various things, answering my own question:
Use middleware.
There are numerous complications with with trying to connect to an authenticated API with Builder, directly. In addition, if there are going to be interactions directly from the browser, you’ll need the middleware anyway. We threw together some code that runs under web app server. Running the middleware under the same name as the website has certain advantages as well.