How do I allow customers to change their passwords without an API token?

Questions OAuth/OIDC
2

@drs
You can use bearer token instead of API token.
Please refer the example in this discussion thread.

To implement this, you need to have “OAuth 2.0 Consent for API Access Management” feature.
If you don’t have the feature enabled, please feel free to send an email to support@okta.com and request OAUTH2_FOR_OKTA_API feature.

Also, for the API token access issue, you can refer the doc here: manage access level for API token.
You need a super admin to manage the access level.