You're talking about if a box is compromised, but to clarify, this is hard coded into the source in the repo, not an end-user's credentials (and it's a `client_id` and `client_secret`, not a token):
https://github.com/clawdbot/clawdbot/blob/7187c3d06765c9d3a7...