Scoped PAT with Full access gets 403 revealing project API keys; classic PAT succeeds

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

A scoped/fine-grained personal access token created using the Full access preset cannot reveal project API keys through the Management API.

This causes supabase link to fail because the CLI requests the project's API keys with reveal=true.

The same Supabase account, project, CLI command, and environment work correctly when I replace the scoped PAT with a classic PAT.

The user that created both tokens is the Owner of the organization, and the scoped PAT shows API Keys: Read-write.

I reproduced this with both:

• a project-scoped PAT
• an organization-scoped PAT

Both were created with the Full access preset and both fail identically.

To Reproduce

1. Sign in as the Owner of a Supabase organization/project.

2. Create a new scoped/fine-grained personal access token.

3. Set Resource access to either:

   • the specific project, or
   • the containing organization.

4. Select the Full access permission preset.

5. Confirm the resulting token has API Keys: Read-write.

6. Set the token as SUPABASE_ACCESS_TOKEN.

7. Run:

supabase link --project-ref <PROJECT_REF> --debug