The tracker's real books are private. If this is your deployment, enter the shared secret from the server's .env (CHAT_SHARED_SECRET); the browser stores only a derived token, never the secret.