Every token has its own secret and can be revoked on its own. Account limits and role are shared by all tokens of an account, so setting them here changes them for its other tokens too.

The account signs in to this dashboard with its name and this password; its role (administrator or regular user) decides what it sees. Setting a new password signs that account out of the dashboard. API tokens keep working.