The browser talks only to this console; it forwards your credentials to the identity service. The console holds no auth secret of its own.