Access is protected server-side. The token you paste is stored only in your browser's local storage on this device.