Hi @Fred, this is normal. The token has to be transferred to Baserow servers, otherwise it wouldn’t know that its you!
The important thing is that the connection to the server itself is secured via SSL (so the requesting address starts with https:// (note the s). When this is the case, data between the client and the server can’t be accessed by third parties as the whole request is encrypted.
Then if you don’t expose this token in any other way it is secure. So make sure the token itself is not leaking/being displayed anywhere.