The Model Manager allows you to control whether your model requires API access tokens or if it can be invoked by anyone. You can set this on the Settings/Invocation page.
If your model is unrestricted, anyone can call your model without requiring a token.
If your model is restricted, the caller must pass in a valid access token.
On the same page you can generate the access tokens needed for access if you restrict your model. You can generate as many access tokens as you want. For convenience, you can use the name field to help you keep track of which tokens have been issued to whom/for what purpose.
You can also revoke or regenerate a token (these actions are available if you click on the Gear icon).
These settings are applied immediately to all running model versions.