Where do I manage my API tokens?

In Settings. You can create tokens there and revoke any of them at any time.

Revoking a token immediately stops every client using it. If you think a token has leaked, revoke it and create a new one, nothing else needs to change.