Is it ok that Storefront API's Access token is public?

[shuntaro1]

I'll use Storefront API.

But it is public on the browser ex Google Chrome.

I want to ask it is ok or not.