Proposal for handling API tokens per-project vs app-wide

Some tokens like a GitHub access token or Pivotal Tracker access token seem to go 2 different ways.

For public repos/accounts, ANY token can be used - the token just authenticates the API call.

For private repos/accounts, a SPECIFIC token is needed that both authenticates the call and authorizes access to that account.

If the above seems correct, then maybe a convention could be that if a gem looks for a value for credential "XYZ" and has no value set per-project, the lookup mechanism would fall back to looking for an app-level credential with the same name.

Hence, the app-wide GitHub token and (soon) Tracker token could be used to access ANY public repo/account on those services, and a separate token would only be needed to "override" it for nonpublic account access.