Kept in a browser session cookie — never bundled, gone when the browser closes, shared across tabs. Keys are minted ops-side via POST /api-keys on the engine.