> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Manage OIDC and OAuth tokens

Use this section to view and revoke OIDC and OAuth tokens issued to users. Token tracking also helps you understand how access is maintained across authentication flows.

The number of tokens a user can have for any OIDC/OAuth application is limited to 50. This applies to Userinfo Access Tokens and JWT Access Tokens issued with a Refresh Token. Once the limit is reached, IDaaS removes the oldest token based on when it was last issued. For a description of the different OIDC and OAuth tokens, see [Integrate OpenID Connect and OAuth Cloud applications](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications.md).

When an authorization request creates an access token, IDaaS tracks that token for future use, such as retrieving Userinfo data or refreshing the token. An administrator can view tokens and revoke them individually from the **User Details** page or revoke all of a user's tokens from the **Token List** page.

note

Revoking a token affects future use of that token, but any already issued tokens remain valid until they expire unless they are also revoked.

## Topics in this section

[📄️Revoke tokens You can revoke tokens. For example, you may want to revoke tokens if a user is an unauthorized user of the resource or a user has left your organization.](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-oidc-and-oauth-tokens/revoke-oidc-and-oauth-tokens.md)