No you're right. The providers should have privileged access to the core API without session authentication.

If we think of Tokens as a security access code, then they are an alternative secured access to session authentication, so you really do not need both.

My idea was implement some custom authentication in DRF similar to http://www.django-rest-framework.org/api-guide/authentication#tokenauthentication but URL-based.

The slight mismatch is that we do not think of a token as an alternative way to identify a User, but a Team. Maybe that is not what we really want, and a user-associated token might be simpler to manage, as it maps more directly to built-in authentication?