AccountID is the provider account the credential should be scoped to, for the providers whose Verify needs one (Cloudflare). Ignored by the OAuth path.
Token is the customer's provider credential. Its PRESENCE — not its value — is what selects the apikey seal over the OAuth flow for a provider that offers both: {"token":"…"}, even empty, is an apikey attempt (→ verify, which answers the "token required" 400 on an empty value), while a body with no token key (the console Connect button, hanzo connector add with no --token) starts OAuth. Read on STDIN by the CLI, never argv; never logged or echoed.