Stored only in this browser and sent as a Bearer token on mutation requests. Configured server-side via OPERATOR_TOKEN.