PocketOS's token was configured for account-level access, the maximum possible permission; Railway acknowledges that the correct scope does exist, but the flow did not make it obvious which one to choose.