How do I revoke a REST API token when someone leaves?

Delete their token from the Created tokens list in App Settings > Rest API Permissions.

That list shows each token's user, creation date, last access and expiry, so an unexpected one can be found the same way.

Related pages

• REST API Endpoints Documentation - where this is covered in full.

• API & Connectivity - more questions on this topic.