It was started with --host, so every request must carry the token printed in the terminal. It is kept in this tab only.
--host