You authorise scopes on login.eveonline.com. ESI tokens are encrypted at rest and can be revoked any time from your EVE account management page.