Hello Frank,
How can you avoid exposing user tokens? What is you way to not returning user tokens from GET/users API?

Thanks.