sandboxd

The same token the API expects in Authorization: Bearer. It is exchanged for a session cookie and is not stored in the browser.