pub fn api_token_path() -> PathBuf
Where the bearer token lives. It is a file rather than an environment variable so it survives daemon restarts and so deleting it is the explicit revoke gesture.