Bug #20568 allow users to create API access tokens, but it always associates all a users permissions with that access token and additionally if that user comes to have more permissions down the line those additional permissions are automagically added to the access token as well. This is generally bad practice for access tokens as in general, they should be of a definite scope and any time additional privileges are required the client application should have to ask for them and receive a new token with the additional privileges assigned to it.
Any developments on this front since almost two years passed? :)
I still hope to get to it at some point.. likely when rebasing Kyle's work on permissions which is on my list for later this month. I envisage an OAuth2 style scopes system from the API perspective.. but th foundations for that are not yet available in Koha permissions code.