This command will do this also:
set str ="$lb("""_$replace($listtostring(x),",",""",""")_")"
There is a caveat though, If the list is empty the $listtostring() will through a NULL exception. So you will need to check for an empty string.
First I have had success just leaving the GetCredentials out, but you are correct in that the documentation says you should have this. Change your GetCredentials code to be just
return $$$GetCredentialsFailed
This will cause the process to revert to normal username and password prompting. You only need to implement GetCredentials code if you are pulling the username and password from somewhere else such as taking the authentication header out of a REST call.
Link to the docs https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GAUTHN_delegated#GAUTHN_delegated_zauthgetcreds







Whether or not using the Adapter over an instantiation of the %Net.HttpRequest is a matter of your needs really. The adapter seeks to make things "simpler" in some way. However if you need greater control over the process and response using the HttpRequest directly is also a reasonable direction. I have done both depending on my needs.
Glad it is working for you in an manner that is maintainable. That is what is important.