The key is stored in your browser (localStorage). It is sent in the Authorization: Bearer ... header.
Authorization: Bearer ...