The API connection is configured server-side via environment variables. Tokens are never exposed to the browser.