Token is stored in the macOS Keychain when available; otherwise in a 0600 file under app data. Never committed.