Ah, and the auth() call does not return the token. Rather it returns a token information object which contains the access token:
Object {token_type: "bearer", access_token: "xxx…", expires_in: 86399993}
Thus, I need to extract tokenInfo.access_token to make an API call. This was not clear in the docs.