high75%
Scoped PAT with Full access gets 403 revealing project API keys; classic PAT succeeds
A scoped/fine-grained personal access token created with the Full access preset cannot reveal project API keys through the Management API, causing CLI commands like `supabase link` to fail with 403. Classic PAT works fine. This indicates a permission evaluation bug for scoped tokens with Full access.