Two-minute guides with the exact token scopes — and the gotchas most people hit. commit-grapher reads metadata only; your tokens stay in your OS keychain.