Creating a custom object schema requires an agency token, and association limits (e.g. "one Account Holder per record") can only be set in the UI. Please allow both with a sub-account Private Integration Token (with the right scopes), so a setup can be scripted, versioned and repeated across sub-accounts without manual clicks.