API tokens can now read which features your account includes, without broader access.

Add the Allowed account features scope to a custom token from the Tokens tab. Strictly need-to-know basis, as the spies say.