# Token Watch

> Token Watch monitors Azure App Registration credentials in Microsoft Entra ID and alerts engineering teams via email or webhook before client secrets and certificates expire, preventing the silent production outages caused by missed token rotations.

Token Watch is built for DevOps, SRE, platform, and security engineers who operate workloads on Microsoft Azure and need reliable expiration alerting for App Registration client secrets and certificates. Azure does not send built-in expiration notifications; Token Watch fills that gap with a read-only Microsoft Graph integration that requires no agents or installations inside the customer tenant.

## Product summary

- **Name:** Token Watch
- **Website:** https://aztokenwatch.com/
- **App:** https://app.aztokenwatch.com/
- **Contact:** contact@aztokenwatch.com
- **Founder:** Maksym Vostruhin — https://www.linkedin.com/in/mvostruhin/

## What it does

- Lists every App Registration in a connected Microsoft Entra ID tenant.
- Reads client secret and certificate metadata (display name, key ID, expiration date) via Microsoft Graph with read-only permissions (Application.Read.All).
- Sends expiration alerts by email (Starter plan) or HTTP webhook (Team plan) for routing into Slack, Microsoft Teams, PagerDuty, ServiceNow, Opsgenie, or any incident management tool.
- Provides per-secret tracking control and filtering to reduce alert noise.
- Exports the credential inventory to CSV (Team plan).

## Security posture

- Read-only Microsoft Graph access. Token Watch cannot modify the customer tenant.
- Secret *values* are never received or stored. Microsoft Graph does not return them after creation; Token Watch only sees metadata.
- Authentication is handled by Microsoft Entra ID single sign-on; Token Watch does not store user credentials.
- No agents, scripts, or installations run inside the customer environment.

## Pricing

- **Free** — view-only visibility into every App Registration credential, no time limit.
- **Starter — $29/month** — active monitoring with email expiration alerts, up to 100 monitored App Registrations.
- **Team — $59/month** — email and webhook alerts, CSV export, priority support, up to 500 monitored App Registrations.

## Key pages

- [Home](https://aztokenwatch.com/): product overview, how it works, why teams use Token Watch, security model, pricing, and FAQ.
- [About](https://aztokenwatch.com/about): why Token Watch exists, the principles behind it, and how to reach the founder directly.
- [Privacy Policy](https://aztokenwatch.com/privacy): how Token Watch handles tenant data, what is collected, retention, and user rights.
- [Terms of Service](https://aztokenwatch.com/terms): the terms governing use of Token Watch, including accounts, acceptable use, plans and billing, disclaimers, and governing law.
- [Refund Policy](https://aztokenwatch.com/refund): how billing and refunds work for paid subscriptions; fees are non-refundable, cancel anytime to stop future billing.

## Blog

Practical guides for Azure engineers on App Registration errors, client secret rotation, and credential expiry monitoring.

- [Blog index](https://aztokenwatch.com/blog): all published guides.
- [Fix AADSTS7000222: client secret keys are expired](https://aztokenwatch.com/blog/fix-aadsts7000222-client-secret-expired): what the AADSTS7000222 error means, the step-by-step fix (create a new client secret, update every place it's used, redeploy, delete the old one), common gotchas, a Microsoft Graph PowerShell snippet to find other expiring secrets, and how to prevent recurrence with monitoring or managed identities / workload identity federation.

## Frequently asked questions

**How do I get notified when an Azure App Registration secret is about to expire?**
Azure does not send built-in expiration notifications. Token Watch scans every App Registration in a connected Microsoft Entra ID tenant and sends an alert by email or webhook before each client secret or certificate expires.

**What permissions does Token Watch need?**
Read-only Microsoft Graph permissions (Application.Read.All). Token Watch cannot modify the tenant, create credentials, or read secret values.

**Does Token Watch see client secret values?**
No. Microsoft Graph never returns the value of a client secret after creation, so Token Watch only sees metadata: name, key ID, and expiration date.

**How long does setup take?**
About a minute: sign in with Microsoft, grant the read-only consent, and Token Watch lists every App Registration in the tenant with its expiration status.

**Can alerts be routed into Slack, PagerDuty, or other incident tools?**
Yes — the Team plan delivers alerts to any HTTP webhook, suitable for Slack, Microsoft Teams, PagerDuty, ServiceNow, Opsgenie, or any incoming-webhook endpoint.

**Is there a free plan?**
Yes. The Free plan gives view-only visibility into every App Registration credential with no time limit.