Worked it out — posting solution here so others can reference it.
SOLUTION: when making an API request, we can indeed pass an access token in the URL using access_token=XXX in the query string — for example, like this:
https://my.directus.domain.com/items/collection?access_token={{my_token}}
We can use this in the ‘URL’ field of the autocomplete input settings to fetch the data from a collection in the database. We can use other query parameters such as fields and filter, just as we normally do when using the API — using {{value}} in the parameters to filter out the responses.
Last of all, in the “Results Path” setting field, enter simply the word data - that is the path - and don’t forget to specify “Text Path” and “Value Path” using the names of the fields you want to use for each.