Your API token is encrypted with AES-256 server-side and stored as an HttpOnly cookie — never readable by JavaScript or written to disk.
LOCAL BROWSER ONLY