When you sign in to the console, you get a short-lived HttpOnly session cookie tied to your team membership. Page scripts can't read it, which keeps it out of reach of anything running in the page. In Settings, under Account, you can see where you're signed in and sign out any other device; the browser you're using is marked This device.
- Sessions are for the browser only. Don't copy a session cookie into a script; use a personal access token or an API key instead.
- Two-factor authentication and passkeys live in Settings, under Account security.