If you set a token, as long as it is a valid token string, it will be accepted and the CLI will deploy the app. But if the API token itself lacks permissions the app itself will fail to load and you'll get an application error.

It would be nice if the Counterscale CLI did a basic HTTP request to Cloudflare to validate the token mostly functions.