> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Token Management

> Managing issued access tokens and refresh tokens outside the protocol flows: listing, creating, updating, and revoking tokens with the Management API.

While the Core API issues and validates tokens as part of OAuth/OIDC protocol flows, the **Management API** lets you operate on issued tokens directly — outside the flows. Typical use cases include building an administration screen, revoking tokens when a user reports a stolen device, or migrating tokens from an existing authorization server.

## Token Operation APIs

| API                                                                        | Purpose                                                                                                     |
| -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| [/auth/token/get/list](/api-reference/token-operations/list-issued-tokens) | List issued tokens. You can filter by client and end-user (subject).                                        |
| [/auth/token/create](/api-reference/token-operations/create-access-token)  | Create an access token without going through an authorization flow. Useful for migration or testing.        |
| [/auth/token/update](/api-reference/token-operations/update-access-token)  | Update properties of an issued token, such as its expiration date and scopes.                               |
| [/auth/token/revoke](/api-reference/token-operations/revoke-access-token)  | Revoke tokens. You can revoke by token identifier, or revoke all tokens of a client or an end-user at once. |
| [/auth/token/delete](/api-reference/token-operations/delete-access-token)  | Delete a token entry itself from the database.                                                              |

<Note>
  Revocation initiated by a *client application* (RFC 7009) is part of the protocol flows and is handled by the Core API [/auth/revocation](/api-reference/revocation-endpoint/process-revocation-request). The token operation APIs above are for *administrative* operations performed by your server or back-office tools.
</Note>

## Relation to Client and Service Lifecycle

Token lifecycle is tied to the entities that issued them:

* Deleting a client affects its issued tokens. See [Token Management Policy When Deleting Clients](/configuration-reference/client-management/token-management-policy-when-deleting-clients).
* Authlete tracks which clients an end-user has authorized, which you can manage per user. See [Authlete's Policy on Managing Clients Which Have Been Authorized by User](/configuration-reference/client-management/authletes-policy-on-managing-clients-which-have-been-authorized-by-user).

## Next Steps

* [Client Management](/get-started/concepts/client-management) — managing the clients that tokens are issued to
* [Service Management](/get-started/concepts/service-management) — service-level settings such as token expiration defaults