Paste your x-game-token and user GUID. They're sent only to gamesapi.worldsurfleague.com from your browser.
x-game-token
gamesapi.worldsurfleague.com
How to find them manually: open fantasy.worldsurfleague.com (logged in), open DevTools → Application → Local Storage. Read the wsl-game-token entry — it's a JSON object — copy game_session_token into the JWT field above and guid into the GUID field. For brackets, copy the userToken entry's value into the bracket token field (it only appears after you've used the brackets section of the WSL app at least once). The bookmarklet does this automatically.
wsl-game-token
game_session_token
guid
userToken