--- a/plugins/mod_tokenauth.lua	Sun Oct 15 16:43:14 2023 +0200
+++ b/plugins/mod_tokenauth.lua	Mon Oct 09 20:26:30 2023 +0200
@@ -159,6 +159,11 @@
 		return nil, "expired";
 	end
 
+	if not grant.tokens then
+		module:log("debug", "Token grant without tokens, cleaning up");
+		token_store:set_key(username, grant.id, nil);
+		return nil, "invalid";
+	end
 	return grant;
 end