An API key could read the names, prefixes and access of your Git HTTPS tokens, although it could not create or revoke them. GET /api/v1/repositories/tokens now refuses an API key with 403, as creating and revoking do; the Magpie app, signed in as you, lists them as before.
Fixed the API listing Git HTTPS tokens to an API key
An API key can no longer list your Git HTTPS tokens; only the Magpie app signed in as you can.