Document how to use scoped API tokens (e.g. service accounts) Change-Id: Ia1a625a49d9c0d86458679c81544257460dabbea