We all think about authentication as a user signing-in. But what about, once signed in, the ‘create api key’ that is a permanent password? Where does that go? Zapier? Script in home dir?