That's probably the best way at the moment. All the core token-getting functions seem to use $wgUser, too.

Since Gerrit change 153110, things have gotten much simpler. Now most API modules will just implement ApiBase::needsToken

public function needsToken() {
    return 'csrf';
}

Using custom salts is discouraged, but if necessary is accomplished using the 'ApiQueryTokensRegisterTypes' hook:

$wgHooks['ApiQueryTokensRegisterTypes'][] = function ( &$salts ) {
    $salts['mytokentype'] = 'salt';
    return true;
};

(then needsToken() would return 'mytokentype' instead of 'csrf')

Wonderful. Can someone make sure this ends up in a some wiki page which extension developers can easily find?

Assigning to Brad as patch author and only person knowing about the feature.