The browser only sends credentials to apps/api. It never stores Firebase tokens or talks to the database directly.