The key is validated by the API and kept only in this tab’s session storage — never stored in the page or sent anywhere but the API. Closing the tab or logging out clears it.