Every search request carries an x-api-token header read from window.__APP_STATE__.apiToken at request time — a value that lives only in the page's own live JS state, never in localStorage/sessionStorage, a cookie, or a separately-served .js file.