You can. You can also create tokens that function the exact same as a password but with a customisable scope.