Looking at the [staging API doc's for the Authentication Services|http://dev.release.rest.doc.sagebase.org.s3-website-us-east-1.amazonaws.com/#org.sagebionetworks.auth.controller.AuthenticationController
], I see
Personal access tokens (PATs) are the preferred replacement for API keys, and can a user may freely generate up to 100 tokens with scoped access using
and the header documentation for the controller stops there.
The source Javadoc has considerable text that is truncated.