How does `az account get-access-token --resource api://<appid>` work behind the scenes to retrieve an access token?

Question

Consider the following command that attempts to retrieve an access token:

az account get-access-token --resource api://<appid>

This works, if the Azure CLI is a preauthorized client application: 04b07795-8ddb-461a-bbee-02f9e1bf7b46

But how does this command works behind the scenes? I suppose the Azure CLI application has no permissions (scopes) on my app, so that's not an option. Also, I don't believe it's executing an OAuth 2.0 On-Behalf-Of flow, because what would be the middle-tier API in this case?

Thank you!