My token was compromised and someone started using my account to do spam crawling of random social media accounts. I am trying to create a new secured token that only has read permissions for https://api.apify.com/v2/acts/apify~cheerio-scraper/runs/last/dataset/items but I can't figure out what combination of permissions I'm supposed to apply for the token to work, as I keep getting 403 or 401. I also cannot figure out how to disable/delete the malicious actors/crawls or disable them because they are monetized?

message has been deleted

Looks like the permissions needed are Actors: Read / List Runs, Storage: Read

Cannot you just refresh so the compromised one would no longer be useful?