What kind of token is required?

So the cli won't start if the token is not read-only, but when you give it a read-only token it then dies with this message:

```
updater | remote: Write access to repository not granted.
```

Seems contradictory to me? Is there a way to get this thing to run?