grant user created api token all scopes