When the server is started with the TT_TOKEN environment variable, every API route requires the token. Without it, the first request returns 401 and opens the token modal.
- Paste the
TT_TOKENvalue you set when launching the server, then save. - The token is kept in the browser's
localStorageacross sessions. - The browser sends it as the
X-TT-Tokenheader; manual clients may also useAuthorization: Bearer. /api/healthis intentionally public so load balancers can probe it — it exposes no sensitive data.

Security note: never pass the token in a query string — those end up in proxy logs. This build removed that path entirely.
