Your cashback, state by state: tracked, pending with its unlock date, available.
Developer setup: your device id and token live in ~/.retriever/config.json.
Browser extension: open the extension popup, this balance shows there directly.
Credentials are sent once to fetch your balance and never placed in the URL.