PAT Token

I want to use some of the curl-based API requests I have seen throughout the documentation in my local docker environment. Correct me if I am wrong, but the easiest way would be to create a service user and a personal access token in the ZITADEL organisation. Then, use this personal access token in the Bearer field for the requests. And which role(s) should my service user have to execute admin-level operations?