The key benefit is that API tokens do not expire (and thus they don't need to be refreshed).

While these tokens do not expire, they can be disabled and / or deleted. We log the use of your API token and provide the timestamp of its last use. A disabled token can be re-enabled. Before deleting a token, we recommend that you first disable it and monitor for any rogue process you might not remember. This will allow you to quickly re-enable a token should something break.

User API tokens are functionally the same as user session tokens. You will be allowed to perform all actions for a given application that your user is scoped to perform. Guard API tokens as carefully as you would your password; they are just as powerful...

🚧
Be careful
Because user API tokens inherit all scopes of the underlying user, they should not be shared. User API tokens are functionally the same as a username and password; they should be guarded just as carefully.
User API tokens should not be used in deployment systems. For backend systems, we recommend using Application API Tokens.

🚧
Security protection
User API tokens cannot be used to transfer ownership of an application or to manage the user's API tokens. Only a user session token can be used in these API calls.