Gitter API Token Scoping and Expiration Limits

Gitter provides API authentication via personal access tokens and an OAuth2 authorization-code flow. While these mechanisms allow programmatic access to rooms and messages, the documentation does not explicitly define a granular permission system for limiting token capabilities.

Implementing a least-privilege security model requires knowing if tokens can be restricted to specific actions (such as read-only access) or if they inherently grant full account permissions. Furthermore, the lack of documented Time-To-Live (TTL) values for access tokens creates uncertainty regarding credential rotation and the handling of expired sessions.

• Does the Gitter OAuth2 implementation support specific scopes to restrict a token's access to read-only or write-only operations?
• Is there a documented expiration period for access tokens, or are they long-lived until manually revoked?
• Does the token endpoint provide a refresh token for session renewal?