Access token can be used to clone code via HTTP(S) protocol without using password. It has same permission over all projects accessible by your account.