Signup once, then keep the browser app and token broker under the same account.

Passwords are stored as scrypt hashes, sessions are verified server-side, and API tokens are stored only as hashes after creation. The raw bearer token is shown once from the integrations page.