Paste your x-game-token and user GUID. They're sent only to gamesapi.worldsurfleague.com from your browser.
x-game-token
gamesapi.worldsurfleague.com
How to find them manually: open fantasy.worldsurfleague.com (logged in), open DevTools → Application → Local Storage, and read the wsl-game-token entry. It's a JSON object — copy game_session_token into the JWT field above and guid into the GUID field. The bookmarklet does this automatically.
wsl-game-token
game_session_token
guid