Enter the client API key once. The server exchanges it for a session
stored in an HttpOnly cookie, so the key is never kept by this page and
is never sent with later requests.
The key is used once to create a session cookie. The cookie is
HttpOnly, Secure, SameSite=Strict
and lasts 30 days. “Keep me signed in” controls whether it
survives a browser restart; without it the session ends when the browser
closes. Sign out revokes the session. The cookie is
Secure, so plain-HTTP localhost cannot retain it — use HTTPS.