diff --git a/invenio_utilities_tuw/cli/users.py b/invenio_utilities_tuw/cli/users.py
index 37193141ea27db3ec55cd78c44efcc0507866746..caf6952845ca337a10f319e6520698122fb2a81a 100644
--- a/invenio_utilities_tuw/cli/users.py
+++ b/invenio_utilities_tuw/cli/users.py
@@ -117,3 +117,20 @@ def find_user(only_active, query, full_name):
 
     else:
         click.secho("no users registered.", fg="yellow")
+
+
+@users.command("tokens")
+@click.argument("user_id")
+@with_appcontext
+def show_user_tokens(user_id):
+    """Show the user's API tokens."""
+    user = get_user_by_identifier(user_id)
+    for token in user.oauth2tokens:
+        fg = "bright_black" if token.is_internal else "white"
+        # TODO optionally show scopes for the tokens
+
+        name = "N/A"
+        if token.client and token.client.name:
+            name = token.client.name
+
+        click.secho(f'{token.access_token}  "{name}"', fg=fg)