This page talks to GitHub directly from your phone. Nothing is sent anywhere else — there is no server in between.
project and nothing else.
A classic token with repo would hand every repository you can see
to whatever gets hold of this phone. This page checks the scopes and refuses
anything broader — the same rule the server enforces.
Create one at github.com/settings/tokens with only project ticked.