You can now assign a scope to Personal API Tokens, controlling exactly what access a token grants.
Previously, every Personal API Token was issued with full admin-level access, regardless of what the token was actually used for. Now, when creating a new token, you can choose one of three scopes - Read, Write or Admin.
This lets you issue narrowly-scoped tokens for CI integrations, scripts, or third-party tools that only need read or write access, reducing the blast radius if a token is ever leaked or compromised.
Existing tokens are unaffected and continue to operate with admin-level access. To start using scoped tokens, generate a new Personal API Token from your user settings and select the desired scope.
To learn more, see Managing API tokens.