Correct, but with react you want to develop on your local machine. This is why we proxy requests to netsuite when developing locally and sign each request
Then when comes time to build the react app you just push it up to netsuite and the current active session is used for authentication
The token authentication is only used for local development