A key is stored only in this browser (localStorage); Google / email login uses a secure HttpOnly session cookie. Both talk to this same origin.