I think I have two suggestions. One is to ask support if there is anything else you need to specify when using an API like that. But I'm note sure if support offers API help.
Plan B is to set up a single generic userid for the button to use to sign in.
var text URLONE = urlroot() & "db/main?act=API_Authenticate&username=xxx&password=yyyyyy";
var text URLTWO = URLRoot()&"DB/"&[_DBID_xxxxx] &"?A=API_EDITRECORD&rid="&[Record ID#]
& "&_fid_22=" & ToText(Now())
& "&_fid_999=" & ToText([Calculated Secret Code];
var text URLTHREE = URLRoot() & "db/" &[_DBID_xxxxx] & "?a=er&key="&[Record ID#]&"&dfid=12";
$URLONE
& "&rdr=" & URLEncode($URLTWO)
& URLEncode("&rdr=" & URLEncode($URLTHREE))
