In which case tokenAuth in Proxy Server works?

Grafana Plugin Development
1

Hi all. I follow “Add authentication for data source plugins” guide, it says I can specify tokenAuth for proxy route in plugin.json. How does it work? What flags should be ON for this feature? withCredentials or basicAuth - should they be ON or OFF? I wish this tokenAuth endpoint could login with email/password on the third side server, receive auth cookie from there and save it in secureJsonData.apiToken, so then it could be automatically used for Authorization: Bearer [apiToken] header.
I have this configs in my plugin.js. Right now if I have no pre-saved apiToken, all my requests fall with 401. What is wrong with it?:

      {
        "path": "grafanaproxy",
        "url": "https://example.com",
        "headers": [
          {
            "name": "Authorization",
            "content": "Bearer {{ .SecureJsonData.apiToken }}"
          },
          {
            "name": "Content-Type",
            "content": "application/json"
          }
        ],
        "tokenAuth": {
          "url": "https://example.com/signin",
          "params": {
            "grant_type": "client_credentials",
            "email": "{{ .JsonData.email }}",
            "password": "{{ .SecureJsonData.password }}"
          }
        }
      }
  ]