API Token bound to user
The API token is bound to the user, so make sure that user which API token will be used has permissions for given actions.
You can always reset your API token in case it was compromised.
Go to settings and click on
Reset API Tokenbutton and it will generate a new token and old one will no longer be usable.