diff --git a/src/gened/base.py b/src/gened/base.py
index 864833a..9101302 100644
--- a/src/gened/base.py
+++ b/src/gened/base.py
@@ -118,7 +118,7 @@ def create_app_base(import_name: str, app_config: dict[str, Any], instance_path:
         # Cache timeout for static files (seconds)
         SEND_FILE_MAX_AGE_DEFAULT=3*60*60,  # 3 hours
         # Free query tokens given to new users
-        DEFAULT_TOKENS=10,
+        DEFAULT_TOKENS=20,
 
         PYLTI_CONFIG={
             # will be loaded from the consumers table in the database
diff --git a/src/gened/lti.py b/src/gened/lti.py
index a7fe351..ced6d5e 100644
--- a/src/gened/lti.py
+++ b/src/gened/lti.py
@@ -95,8 +95,8 @@ def lti_login(lti: LTI) -> Response | tuple[str, int]:  # noqa: ARG001 (unused a
         'auth_name': None,
         'ext_id': lti_id,
     }
-    # LTI users given 0 tokens by default -- should only ever use API registered w/ LTI consumer
-    user_row = ext_login_update_or_create('lti', user_normed, query_tokens=10)
+    # LTI users given 0 tokens by default -- should only ever use API key registered w/ LTI consumer
+    user_row = ext_login_update_or_create('lti', user_normed, query_tokens=0)
     user_id = user_row['id']
 
     # check for and create role if needed
diff --git a/src/gened/oauth.py b/src/gened/oauth.py
index bad5f48..633f4e2 100644
--- a/src/gened/oauth.py
+++ b/src/gened/oauth.py
@@ -114,8 +114,9 @@ def auth(provider_name: str) -> Response:
 
     current_app.logger.debug(f"SSO login: {provider_name=} email='{user_normed['email']}' full_name='{user_normed['full_name']}'")
 
-    # Given 10 tokens by default if creating an account on first login.
-    user_row = ext_login_update_or_create(provider_name, user_normed, query_tokens=20)
+    # Create a new user (with default # of free tokens) or update the existing if matched
+    tokens = current_app.config.get('DEFAULT_TOKENS', 0)
+    user_row = ext_login_update_or_create(provider_name, user_normed, query_tokens=tokens)
 
     # Get their last active class, if there is one (and it still exists and user has active role in it)
     last_class_id = get_last_class(user_row['id'])