Requests run from your browser against the selected server. API credentials stay in memory. Your API must allow this site's origin through CORS.