Classify API token as password