ASTRA · TRADER

Token is sent once over TLS and exchanged for an HttpOnly session cookie. It never appears in a URL.