The access token is sent as Authorization: Bearer … on every API call and stored only in this browser (localStorage).
Authorization: Bearer …