Owner-only access. The admin token stays server-side only and is never shared in the browser bundle or GitHub.