personal access token

When a person signs in to a service they type a password and often confirm on their phone. A script cannot do that, so services issue personal access tokens instead: a long string of characters that stands in for the account. Whoever holds the string can do whatever the token is allowed to do, with no second factor and no questions asked.

That is why two settings matter more than anything else. Scope decides what the token may touch, and a token that only needs to read one library should not be able to administer your whole codebase. Expiry decides how long a leak stays dangerous. Tokens that never expire have a habit of turning up years later in old build logs and forgotten files, still working perfectly.