Travis CI API token generation – missing repo‑scoped permission boundary

The goal is to configure Travis CI automation so that API tokens used for triggering builds or accessing repository data are limited to a single repository, adhering to a least‑privilege principle. Currently, token generation in the account settings produces an account‑wide token by default, and the public documentation does not specify whether a repo‑scoped alternative exists or how administrators can enforce such a boundary. This lack of a clear permission constraint leaves an unresolved decision about the default token scope and the configuration needed to restrict access.

Does Travis CI provide a way to generate API tokens scoped to an individual repository? If such tokens are not available, what configuration or workflow can be used to enforce least‑privilege access for automated builds? Should the token‑creation UI expose a repo‑scoped option by default to guide users toward the minimal required permission?