Snyk API token permissions users can control

To set an API token to have read-only permissions so the user is unable to write to the platform, use a service account and set it to Group Viewer.

Service accounts at the Organization level have only Organization Admin and Organization Collaborator permissions. Thus, to set a service account to view only, you must use a Group-level service account.

For more information see Service accounts.