I am using GitHub token as the credential for others people.
Can make the token only allows the user to clone and pull, but NOT push or delete.
GitHub tokens do not provide access to a repository, it is mainly to provide authentication of the user. Clone or Pull or push are mainly GitHub repository functions and you can manage specific access using Setting --> Contributors for the repository. Select the "Read" option in the contributors option of Repository Settings.