I’ll reply to my own post for future reference, as further digging allowed me to find how to set up API calls inside a card: the process is described in the docs,
https://app-eu1.hubspot.com/docs/{hubspot instance}/doc/platform/serverless-functions
(obviously replace with your instance number)
It seems each project saves its token in variable PRIVATE_APP_ACCESS_TOKEN
so instanciating a hubspot Client like this:
const hubspotClient = new hubspot.Client({accessToken: context.secrets.PRIVATE_APP_ACCESS_TOKEN,});
works perfectly well!