The credential is stored in a secure, http-only cookie and never exposed to the browser.