What are all of the Access Tokens in my account?

I am experimenting with using the cloud API to “List Access Tokens”, per the Cloud API documentation. I was surprised by the large number of access tokens that return in the JSON object. There seems to be one token for the client “user”, which is the token that I expected to get back (the one that I see on the IDE). But there are MANY other tokens, most with the client “PASSWORD_ONLY” and a few others, such as client “spark-ide” and client “cloud-compile”, client “ifttt”, etc. I think that I understand these latter tokens, but not the many “PASSWORD_ONLY” ones. What are these, and do I care what they are?

I need an access token that I can use to obtain a list of the devices in my account, and an access token to use in getting cloud variable data and calling function functions on a selected device. Is the “user” access token the one that I need for all of these operations? Can I count on there being only one user access token in my account?