Why can t I obtain a user token from a compromised API

Question

During a penetration testing exercise, I was able to access a vulnerable API endpoint, but I can’t seem to retrieve any user tokens. I expected that, after compromising the API, I would be able to extract sensitive data, including tokens.

Could there be additional security mechanisms in place preventing token retrieval, or am I missing something in my approach? What might be the reasons for this difficulty, and are there specific techniques for handling this situation when conducting a security assessment?