path where the encrypted token blob is stored
64-character hex string representing a 256-bit AES key
Alternative constructor accepting a pre-built SecretKey.