from Gemini:
"Users can generate PATs unless you restrict who can create them (e.g., via role permissions).
If your goal is to prevent SDKs from using PATs
SDKs generally do not use PATs — they use SDK keys.
If you want to prevent PAT-based API access:
• Restrict which users have permission to create PATs (Admin-only).
• Rotate or revoke existing PATs.
• Use network-level controls (e.g., block API access except from specific services).
If your goal is to use a different authentication method for SDKs
GrowthBook is moving toward:
• Bearer token support for mobile SDKs (open issue)
• OIDC-based SSO for dashboard users (already supported)
But none of these disable PATs."