I stopped reading the logs and read the raw API requests — here's where my tokens actually go