In keeping with our commitment to researcher control of their ORCID record, the record holder can choose to revoke any access token at any time by deleting it from permissions in the Trusted Organization list under their Trusted parties page.
As of 2018, researchers can only grant long-lived access tokens which last for 20 years unless the user revokes permission.