Review the field.

Admin requests use a bearer token and never expose payment secrets to the browser.