@require https://sync.wmekit.com/wme-sync-lib.js handles first-sync setup, showing or asking for the PIN, token storage and refresh for you.

// ==UserScript==
// @name         My WME Script
// @match        https://www.waze.com/*editor*
// @match        https://beta.waze.com/*editor*
// @require      https://sync.wmekit.com/wme-sync-lib.js
// @grant        GM_xmlhttpRequest
// @grant        GM_getValue
// @grant        GM_setValue
// @grant        unsafeWindow
// @connect      sync.wmekit.com
// ==/UserScript==

unsafeWindow.SDK_INITIALIZED.then(async () => {
  const sdk = unsafeWindow.getWmeSdk({ scriptId: 'my-wme-script', scriptName: 'My WME Script' })
  await sdk.Events.once({ eventName: 'wme-ready' })

  // On the first call in a browser it sets up sync: new usernames get a PIN (shown to the
  // editor), existing ones are asked for theirs. Tokens are remembered after that.
  const sync = await WMESync.init({ scriptId: 'my-wme-script', sdk })

  const settings = (await sync.get('settings')) ?? { highlight: true }
  settings.lastOpened = Date.now()
  await sync.set('settings', settings)
})