I think this question is actually three questions.
Username/password authenticates the user to the application. This establishes a user identity. If you then issue them an API token, this authorizes them to use particular API functionality. Encryption should be completely decoupled from these other actions and handled entirely server-side. An example flow:
User A logs in to example.com. As part of the authentication flow, they are issued a signed bearer token that contains their user identifier and their permission set (standard user). This user wants to view a private document in their account. Their browser makes an API request and passes the bearer token (plus a CSRF token, etc) with the request. The API then validates the permission set on the token and the user identifier's access to the resource. If the authorization check succeeds, the server retrieves the appropriate encryption key (from a secure store) for the resource, decrypts it, and returns it to the user.