The token is generated on first run and stored at ~/.config/gitsec/web-token. Set GITSEC_WEB_TOKEN to override it.