A personal access token is exactly what GitHub popularized: you log into your account, click a button, pick some scopes, and get a token you can put in an Authorization header immediately. No application registration, no redirect URI, no client secret, no dance.
Every API provider using OAuth should offer one. The full OAuth flow exists to solve third-party delegation — an app acting on behalf of a user who is not the developer. An enormous share of real API usage is not that. It is a developer, an analyst, a script, or a partner accessing their own account. Forcing that case through a flow designed for a different case is pure friction with no security benefit.
Do it properly, though. Scope the token so it grants only what the user selects, show it once, let the user name it and see when it was last used, support expiry, and make revocation obvious and immediate. A personal access token that is all-powerful and never expires is a liability you have handed your users.
My rough test for the whole onboarding experience: signup, a personal token, and a runnable collection should get somebody to a successful first call inside ten minutes. Most APIs still are not there, and the missing personal token is usually the reason.
