Clarify scopes required for DANGER_GITLAB_API_TOKEN

doc/development/dangerbot.md

@@ -154,8 +154,9 @@ Danger is run but its output is not added to a merge request comment if working
 on a fork. This happens because the secret variable from the canonical project
 is not shared to forks. To work around this, you can add an [environment
 variable](../ci/variables/index.md) called `DANGER_GITLAB_API_TOKEN` with a
-personal API token to your fork. That way the danger comments are made from CI
-using that API token instead. Making the variable
+[personal API token](https://gitlab.com/-/profile/personal_access_tokens?name=GitLab+Dangerbot&scopes=api)
+to your fork that has the `api` scope set. That way the danger comments are made
+from CI using that API token instead. Making the variable
 [masked](../ci/variables/index.md#mask-a-cicd-variable) makes sure it
 doesn't show up in the job logs. The variable cannot be
 [protected](../ci/variables/index.md#protect-a-cicd-variable), as it needs