I'd like to know also - don't fully understand api, tokens stuff. Can user get log of what the (stolen or not) tokens were used for? Or that just kept by the provider in secret