The password is only sent as a header to the API; it is never stored.