Wonder if the doc language can nonetheless be improved to add a stronger warning to the docs that only oauth tokens are valid to use for this. I also didn’t make the connection when reading and fiddled with non-oauth tokens for a while before Googling to find this thread 
Happy to take a stab at a re-wording though not sure if docs are driven from a GitHub repo?