The current token systems will be replaced by JWTs, so this is more important to get done for JWTs.

There should be an audit log (similar to what Account List has) for who created a token and when.