I would call it perfect if they wouldn't even allow to enter your token.

Imo, that just gives people bad habits when it comes to security.

It feels similar to how many nostr clients just straight up ask for your nsec. As if there is no other way.