A key, if you want one.
The API needs no credential. A key raises your limit from 120 requests a minute to 1200, gives usage an owner, and is metered: each call is charged against a balance that starts with a $5.00 trial. When it runs out the key returns 402 and the free anonymous tier still works. It unlocks no data — everything the API serves is already public.
asks for read:user and nothing else
Three things worth knowing.
Only a SHA-256 hash is stored, so the key cannot be recovered or shown again. Sign in a second time and it rotates — the old one is revoked in the same transaction.
Because keys need an owner. Without some identity, minting keys is free and the limit stops meaning anything — one person could hold a thousand. GitHub is the identity a developer already has.
Your GitHub id, login and the key hash. Not your email, not your repositories, not your followers. The requested scope is read:user.
Prefer not to? Ask, and a key is issued by hand — npm run key:issue. The API works either way.