The browser gets a signed 14-day session, never your API token. Agents authenticate separately with Authorization: Bearer.