No admin audit log for auth tokens

How it was found

There seems to be no audit trail for auth tokens.

• Creating tokens
• Revoking tokens
• Scope changes
• Renames
• Marking the token to be wiped

Impact

As auth tokens are used to access your data having a track record when they are created helps a lot. If you also take https://hackerone.com/reports/1193321 into account this would have been good information to track down what happened and by who.