Leave information about expired access tokens
Proposal
Correct me. Once the access token expires, you remove the token from the list and all information about it. At the same time, setting the token expiration date is recommended. And the shorter the validity period, the better for security. But
You delete all information that accompanied the token, at least the access levels (scopes), name, and expiration period. After the token expires, I need to create a new one. But do I remember which token expired and what levels it provided? How long should I allocate the validity period for a new token?
I think you should leave expired tokens in the list, or at least information about them, with a note that they have expired and are no longer valid. It is advisable to have a button to recreate this token. With the same access levels, the same name and the same validity period (one month, six months, etc.)