I think it's the Setup>Log in using OAuth 2.0 Access Tokens

@Israel Gonzalez Ah, brilliant, that works! I figured that since I don't use the TBA flow that wouldn't apply, but clearly the permission is required at least for the role to be selectable. Thanks!