Mint one per device on the pod:
cm-admin token add <name> --scope write|read
The token stays in this browser only and is sent as a Bearer header. "Forget this device" erases it, with the cached listing. To revoke it everywhere, run cm-admin token revoke <name> on the pod. Signed in with Google, a session lasts 30 days; "Forget this device" ends it, and cm-admin session revoke <email> on the pod ends them all.