The token is a password: anyone holding it can read the whole site. Send it over HTTPS, and tick <strong>Delete the token and close this door</strong> when it is no longer needed. Tick <strong>Replace this token with a new one when saving</strong> to rotate it; the old one stops working immediately.