Saved tokens are kept in this browser's local storage, in plain text, so the auth matrix can fire as each of them. Anything with access to this profile can read them. Use throwaway tokens, and do not enable this console on a production cell.
Everything below is discovered from /console/manifest and the schemas in the
OpenAPI document, filtered to the active token's roles. This is a testing tool, not an
HMI.