Store the token in an environment variable, never in the page.