API Tokens
API tokens under Settings → Manage Tokens → API tokens now carry a role, so a token can be scoped to what it actually needs rather than defaulting to full account access.
For creating and deleting tokens, and how each account type gets its own tokens, see Manage API Tokens — that part is unchanged. This page covers roles.
Roles
A token can be assigned Admin, User, or Read-only — the same roles and the same per-feature access as user roles. See that page for exactly what each role can and can't do.
Every token created here gets Admin by default, including tokens created before roles existed, so if you want a scoped token, set the role explicitly rather than leaving it at the default.
Set a token's role
Select the Role column on an existing token to change it, or set it while creating a new one.