Sign in with the admin API token. It is stored in a server-side session cookie and is never exposed to the browser.