This deployment is gated by an API key. The value is stored only in this browser tab (cleared when you close it) and is sent to the server as part of the WebSocket connection URL to authenticate the session. The server compares it with constant-time comparison and does not log the value.