Let website user access api flask
The way I ended up going was combining both approaches. user_logged_in fires whenever a user logs in. I used that method to generate an api-token and store it in the user object at login. Then, when the user wants to make an api call, the token is simply retrieved from the user object. 
I'm not sure if this is best practice, but it seems to be working fine.
I have two web applications. One is a website. The other is an API. Both are built using flask. They use different methods of authentication.
The website uses the flask-login library. Specifically, is uses login_user if user.check_password supplied by a form is true.
The api uses a cryptographically signed token. The api is used by mobile applications (ios for example). These applications make a call to /api/login and POST the same username and password that you would expect on the website. The api then returns a token which the app stores and uses for authentication in the future. The token is generated using the itsdangerous library. Specifically, it is created using TimedJSONWebSignatureSerializer.
I am experiencing a confusing problem, now, where one of our website pages needs to access our api. Of course the api won't allow access, because the user doesn't have a properly generated auth token. I have control over every part of the code, but I'm not sure what the most elegant solution is in this case. Should I stop using one of the authentication mechanisms? Should I somehow store the api auth token for the website user? 
Any advice would be appreciated.
UPDATE
As I think about this problem, it occurs to me that I could change the token generation process employed by login_user. If login_user used the same token as the api, then presumably I could get the token from the session whenever the user needed to make an api request via the website. Not yet clear if this is insane.