For the REST API and the MCP server. A token acts with your access — it can reach every trip you're a member of, and nothing else.
Building against the API? Read the docs.