#!/bin/bash
html='<html>
<head>
<title>My App</title>
</head>
<body>
<div id="app"></div>
<script>window.API_URL = '"''"'</script>
</body>
</html>'

MY_API_URL='https://w...content-available-to-author-only...e.com/api'
sed 's/\(window\.API_URL =\)[^<]*/\1 "'"${MY_API_URL//\//\\\/}"'";/' <<< "$html"