A token on Platform is a configuration hanging off a data contract, so making one means publishing a contract. What you decide there — decimals, supply, who may ever mint — is fixed the moment it lands.
All three want an AUTHENTICATION key, and the level differs: publishing a contract takes CRITICAL or HIGH, moving a token takes CRITICAL. The TRANSFER key is CRITICAL too and can do neither — it only moves credits. On a standard identity the key you want is #2; keygen lays out all five, and can add one that is missing.
The whole starting supply is created at publish time and lands on this identity. Nothing here can be changed afterwards and the contract cannot be withdrawn, so read it back before you press the button.
Freezing makes someone else's balance unusable, so it is off unless you ask for it. Destroying a frozen balance is never switched on here.
Only for a token published with minting left on. A fixed-supply token already handed its whole supply to the issuer — there is nothing to add.
Platform cannot list holders: balances sit in a tree keyed by identity and nothing walks it. So this reads the token's history instead — every mint, transfer, burn and purchase — collects everyone who ever touched it, and looks up what each one has now. No key, and it works on any token, not only your own. Looking an identity up above fills this in for every token it holds — the box is for one it does not.