REST API
Send a personal API token as Authorization: Bearer. The REST API doesn’t accept OAuth tokens. A token belongs to your user, so it reaches every project you can access. Pick its abilities when you create it through the API.
read- Configuration, analytics, data, and export status GET routes.
write- Everything read can do, plus creating, updating, and deleting configuration and starting exports.
publish- Publishing the project draft. It doesn't grant the read or write routes by itself.
*- Every ability. Tokens created in the app, or without abilities, get this by default.