docs: mark MintAPIToken deprecated in favour of MintAPITokenFor

classes/api_tokens.go

@@ -52,6 +52,10 @@ func APITokenPrefix(app *backpack.App) (string, error) {
 // callers, every member token scope a catalog compiled in this process
 // declared (CompileAPITokenScopes). New code calls MintAPITokenFor, which
 // checks the scopes against the application's own catalog.
+//
+// Deprecated: the declared-scope fallback is process-wide, so in a process
+// that boots several applications it accepts another application's scopes.
+// Use MintAPITokenFor.
 func MintAPIToken(prefix string, userID uint, name string, scopes []string, expiresAt *time.Time, collectionIDs []uint) (string, *models.APIToken, error) {
 	return mintAPIToken(prefix, userID, name, scopes, expiresAt, collectionIDs, func(scope string) bool {
 		return slices.Contains(AllowedAPITokenScopes, scope) || declaredScopes.has(scope)