Stored only in your browser (localStorage), sent as an Authorization header directly to the API. Never sent anywhere else.
Also stored only in your browser, sent directly to the API as request headers. Never sent anywhere else.