Using an API token for a different instance does not fail when creating media entities from the browser

Another interesting thing to note that the requirements check in hook_requirements() does not fail with this scenario. The call to getBrands() still works even without a valid API token.

There are 3 different authentication things that make all of this quite confusing and settings overrides might not work as expected. Ther's the server-side authentication, thre's the per-user oauth login state stored in the session if you use the upload feature and then there's the compact view login state that's completely detached from Drupal.

Try to log out completely to check if that's causing issues.

In the past, it was possible to specify a different URL/portal in the compact view than what was used by Drupal, causing weird problems too, that should be enforced now.

We are using the server-side API permanent token and the compact view only (no upload).