An API token can now be created as purge-only: it is limited to one zone and can only purge that zone's cache and list its purges. Any other route, MCP included, answers 403 token_scope. It is the token to give a CI job that purges after each deploy.
See the Cache documentation.