[BUG] Claude Code OAuth grants never expire and accumulate per sign-in; non-Code grants invisible in Settings; list API capped at 1000

What's Wrong?

Every Claude Code sign-in creates a new server-side OAuth grant on the claude.ai account. These grants never expire, are never revoked when the same machine signs in again, and accumulate without bound. Each one remains a live credential.

Observed on one account (macOS, Claude Code CLI + desktop app):

• Settings → Claude Code → Authorization tokens shows 197 active grants (as of 2026-10-08), 40 pages of 5, oldest created in March 2026.
• The grant records have no expiry. GET /api/oauth/organizations/{org}/oauth_tokens returns {id, application_name, scope, is_revoked, created_at, updated_at} with no expires_at. By contrast GET /api/auth/sessions/list-active (browser sessions) does carry expires_at (7d / 28d).
• Non-Claude-Code grants are invisible and unrevocable in the UI. The Settings page only lists application_name = "Claude Code". In July 2026 the same API returned grants for Cowork (312), Claude for Desktop (54), Claude for Chrome (4) and Claude in Office (1) alongside Claude Code (629). No UI anywhere shows or revokes those.
• The list API is capped at 1000 records and ignores paging. limit, offset, page, cursor, before_id, include_revoked are all silently ignored, so the true total cannot be enumerated, and in July the newest grants shown in the UI were not even inside the API's 1000-record window.
• No way to identify a grant. No device name, IP, last-used time, or token fragment per row (see #99702), and no bulk or "revoke all but this device" action. Revoking stale grants means one confirm dialog per row, guessing by creation date.

What Should Happen?

• Re-authenticating from the same client/device should replace or revoke that device's previous grant instead of minting an additional one.
• Grants unused for some period (e.g. 90 days) should expire, as browser sessions already do.
• The Settings page should list every application's grants (Cowork, Desktop, Chrome, Office), with last-used time and device/client info.
• Provide "revoke all except this device" and multi-select revoke.
• The list API should paginate.

Why it matters

A grant copied off an old laptop, backup, or keychain export stays valid indefinitely, and the account owner has no way to see it (for non-Code apps) or tell it apart from legitimate ones. Related: #96630 (a stale client kept consuming quota and the responsible token was hard to find).

Steps to Reproduce

1. Sign in to Claude Code (claude /login) on a machine; note the count in claude.ai Settings → Claude Code → Authorization tokens.
2. Sign in again on the same machine (or reset credentials and sign in again).
3. Count increases by one; the earlier grant stays active indefinitely.
4. Sign in to Cowork / Claude for Desktop / Claude for Chrome: those grants never appear on the Settings page.

Environment

• Claude Code CLI and Claude desktop app (Code tab), macOS
• claude.ai web, Settings → Claude Code