In light of this change, is it fair to assume that this is only temporary while you create a way for a token to be defined globally rather than needing each unauthenticated script or API to be modified in order to become authenticated prior to running its usual commands?
This effectively just reverts back to the v4 behavior. We are still deciding how to best handle it moving forward. I wouldn’t say this is temporary as this setting will remain but not clear on how else we will allow configuration of this.
We don’t really need a token because of how the internal auth works but we could have it so you could configure the default permissions granted to non-user-initiated scripts. We could also make it a bit more granular where you could specify it per environment or something. Probably a 5.1 thing.