The Tokens table

Every token the platform issues — outbound client tokens (for OAuth client connections) and inbound provider tokens (issued to consumer apps) — is a record in one native Management table, governed like any other table: a standard list, columns, filters and a Revoke action.

The native Tokens table in Management — client and provider tokens with secret columns redacted

What you see (and what you don't)

Kind — client (outbound) or provider (inbound).
The connection / consumer it belongs to, the subject user, scope, type, and the issued / expiry / last-used timestamps.
Secrets are never shown. Reversible client tokens are stored encrypted and render redacted; provider tokens are stored as a one-way hash only. The list surfaces governance metadata, never a usable credential.

Revoking

The Revoke action (available on active tokens) is a soft delete: it moves the record to revoked, and both the access and refresh credentials stop resolving immediately on the next request.

The table is a system, staff-only surface and is never exposed to the API itself.