Fix: Enforce API Token Scope-Based Access Control (#4737)