A card in the Access group beside Members and single sign-on rather than a new nav entry — /settings/instance was folded back in for exactly this reason. The plaintext is shown once in a well block and never again. Tokens outside a newly tightened lifetime policy are flagged rather than broken, because the policy governs issuance, not existing credentials.