On Windows, you have to use the Registry Editor to locate and delete them. This Stackoverflow article describes where they live on different versions of Windows. The Ecobee tokens are kept under the userRoot.
When I contribute an OH2 binding for Ecobee, I will store the ever-rotating tokens in a text file for easier access. That being said, the cases where the tokens become invalid (disk error, not registering the PIN in time) can’t be changed in code, as PIN registration and token rotation every hour is imposed by the Ecobee API.