A script needs limited access to selected repositories. Which credential approach follows least privilege?

1. A shared organization-owner password
2. A token with every possible scope indefinitely
3. A public URL containing the password
4. A narrowly scoped token with appropriate repository access and expiry