Paste an admin key (tma_...) or the bootstrap token. It is validated by the API, then stored only in an encrypted, HttpOnly cookie for 4 hours.