Merchant token permissions