Bubble's admin API guide explains the broad access of administrator tokens. A Bubble integration should not treat those tokens like ordinary user sessions constrained by privacy rules.
Keep them server-side and test the intended access model with non-admin credentials where appropriate. Follow deployment requirements when revoking live access.
Akousa