---
title: "List connected apps and personal tokens · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/connected-apps
updated: 2026-10-20
licence: "All rights reserved"
---

# List connected apps and personal tokens

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Show each person every app, agent and personal token that acts for them, with its scopes and last use. Let them revoke each one.
- How: List OAuth grants by app name, scopes, date granted and last use. List personal tokens by name, scopes, last four characters, expiry and last use. Revoking a grant ends its refresh tokens at once. Give new personal tokens an expiry by default, such as 90 days. Store tokens as the [API keys rule](https://agentwranglers.se/playbook/api-design/api-security/api-keys) says.
- Check: Grant a test app access and make a personal token. Both appear in settings. Revoke both, and their next calls answer 401.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/connected-apps`.

- Previous: [End sessions when access changes](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/end-sessions-on-change)
- Next: [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)