One shared token, no accounts. This gate exists so the rig is not open to the internet — it is not customer authentication and should never be pointed at real client data.