Apparently, on Windows machines where "RSA Authentication Agent" is installed, it's possible to leverage that to provide authentication services. It seems there's some documentation/SDK somewhere for doing this. It seems it's possible to statically link this functionality in, or load it dynamically by calling some functions exported from "aceclnt.dll".
However, since RSA's website was moved to emc.com, all links to old site are dead. I can't find the docs anywhere on the new site. Please help me google this!
We can trivially use SecurID authentication in our application on UNIX/Linux, via PAM. It's only on Windows where we need to use some special SecurID API to query whether to accept/reject the credentials.
Three years later, and the answer has changed: the docs are available for download freely on RSA's website!
https://community.rsa.com/docs/DOC-36840
Without any support contract, you can now download and read the "Authentication Agent API 8.1.1 for C Developers Guide".