Travis CI API authentication and OAuth token expiration behavior

Travis CI relies on API tokens for programmatic access and OAuth tokens for integration with identity providers like GitHub or GitLab. While repository-level permissions allow for some access control, global API tokens often grant broad account-level privileges, complicating the implementation of a strict least-privilege security model.

There is uncertainty regarding how the platform handles the lifecycle of these credentials when they expire. Specifically, the distinction between the manual regeneration of static API tokens and the automatic rotation of OAuth-based identity tokens is not fully defined for all integration types.

• Does Travis CI support automatic renewal of expired OAuth tokens without manual intervention in the UI?
• What is the specific mechanism for restricting a global API token to a single repository to achieve least-privilege access?