Where to find it: Trak → Settings → API.
What happens to it: it is encrypted, tied to your email and stored in a cookie your browser cannot read from script. It is never written to disk, never logged, and never sent back to the page. It expires after 8 hours, and disconnecting drops it immediately.
Writes still stop at a confirm card — the assistant asks before it changes anything.