The Console's product APIs accept user, user:read and products:read only (decision 21 names products:read). A token with just "products" was refused everywhere despite its consent text.