This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile - so it's still scraping your profile page, but that feels like a very low-impact way of building this.
Suggestion: on the "Put the token below in your HackerNews Profile" page, rather than polling to see if the token has been added (which is a bit rude) add a button for "I have added this token to my profile" and only check once the user clicks that button.
Suggestion: on the "Put the token below in your HackerNews Profile" page, rather than polling to see if the token has been added (which is a bit rude) add a button for "I have added this token to my profile" and only check once the user clicks that button.