diff --git a/api/components/Tokens/TokensFactory.php b/api/components/Tokens/TokensFactory.php
index 992c909..2af8142 100644
--- a/api/components/Tokens/TokensFactory.php
+++ b/api/components/Tokens/TokensFactory.php
@@ -35,9 +35,9 @@ class TokensFactory {
     public static function createForOAuthClient(AccessTokenEntityInterface $accessToken): Token {
         $payloads = [
             'aud' => self::buildAud($accessToken->getClient()->getIdentifier()),
-            'ely-scopes' => array_map(static function(ScopeEntityInterface $scope): string {
+            'ely-scopes' => implode(',', array_map(static function(ScopeEntityInterface $scope): string {
                 return $scope->getIdentifier();
-            }, $accessToken->getScopes()),
+            }, $accessToken->getScopes())),
             'exp' => $accessToken->getExpiryDateTime()->getTimestamp(),
         ];
         if ($accessToken->getUserIdentifier() !== null) {
diff --git a/common/tests/unit/tasks/ClearOauthSessionsTest.php b/common/tests/unit/tasks/ClearOauthSessionsTest.php
index e962ba5..3246867 100644
--- a/common/tests/unit/tasks/ClearOauthSessionsTest.php
+++ b/common/tests/unit/tasks/ClearOauthSessionsTest.php
@@ -38,14 +38,14 @@ class ClearOauthSessionsTest extends TestCase {
         $task->notSince = 1519510065;
         $task->execute(mock(Queue::class));
 
-        $this->assertFalse(OauthSession::find()->andWhere(['id' => 3])->exists());
-        $this->assertTrue(OauthSession::find()->andWhere(['id' => 4])->exists());
+        $this->assertFalse(OauthSession::find()->andWhere(['legacy_id' => 3])->exists());
+        $this->assertTrue(OauthSession::find()->andWhere(['legacy_id' => 4])->exists());
 
         $task = new ClearOauthSessions();
         $task->clientId = 'deleted-oauth-client-with-sessions';
         $task->execute(mock(Queue::class));
 
-        $this->assertFalse(OauthSession::find()->andWhere(['id' => 4])->exists());
+        $this->assertFalse(OauthSession::find()->andWhere(['legacy_id' => 4])->exists());
 
         $task = new ClearOauthSessions();
         $task->clientId = 'some-not-exists-client-id';