The key is held in sessionStorage and sent as X-Admin-Key on every API call. It is never baked into the bundle.