1- You can pass information possibly as query parameters for the instant app URL. Depending on the sensitivity of these parameters, you may want to do a different approach, to make sure they're not intercepted by other apps in between. Maybe a more reliable approach is to for the integrating app to expose a ContentProvider to your instant app with these credentials.
2- For theming, you won't be sharing contexts with the integrating app, so you'll need to use the method you pick for (1) to also achieve this.
These aside, I think using instant apps for SDKs maybe a bit unreliable for multiple reasons:
- Instant apps need to have a corresponding full app available on Google Play, and users will need to be able to "upgrade" the instant app to a full app experience.
- Not all devices support instant apps yet. The coverage is increasing, but it's still not available to all devices.
- Even when a device supports instant app, the user can still opt out from a specific instant app, or disable all instant apps. You will need to have the URL invoking to your instant app work the same and provide same functionality through web browsers, if users don't go through the instant app.