diff --git a/app/models/access_token.rb b/app/models/access_token.rb
index e7acbbc5f64..1d753e3c2fb 100644
--- a/app/models/access_token.rb
+++ b/app/models/access_token.rb
@@ -43,6 +43,7 @@ class AccessToken < ActiveRecord::Base
 
   scope :active, -> { not_deleted.where("expires_at IS NULL OR expires_at>?", DateTime.now.utc) }
   scope :not_deleted, -> { where(:workflow_state => "active") }
+  scope :visible, -> { joins(:developer_key).where('developer_keys.internal_service is not true') }
 
   TOKEN_SIZE = 64
 
diff --git a/app/views/profile/profile.html.erb b/app/views/profile/profile.html.erb
index 1f13f62f4df..f070f60becd 100644
--- a/app/views/profile/profile.html.erb
+++ b/app/views/profile/profile.html.erb
@@ -457,7 +457,7 @@ TEXT
 <% end %>
 <h2><%= before_label(:'headers.approved_integrations', "Approved Integrations") %></h2>
 <div style="margin-<%= direction('left') %>: 20px;">
-  <% if @user.access_tokens.empty? %>
+  <% if @user.access_tokens.visible.empty? %>
     <div id="no_approved_integrations"><%= t(:no_approved_integrations, <<-TEXT)
       Third-party applications can request permission to access
       the Canvas site on your behalf.  As you begin authorizing
@@ -465,7 +465,7 @@ TEXT
       TEXT
     %></div>
   <% end %>
-  <div id="access_tokens_holder" style="<%= hidden if @user.access_tokens.empty? %>">
+  <div id="access_tokens_holder" style="<%= hidden if @user.access_tokens.visible.empty? %>">
     <%= t(:approved_integrations, <<-TEXT)
     These are the third-party applications you have authorized
     to access the Canvas site on your behalf:
@@ -482,7 +482,7 @@ TEXT
         </tr>
       </thead>
       <tbody>
-        <%= render :partial => "access_token", :collection => @user.access_tokens %>
+        <%= render :partial => "access_token", :collection => @user.access_tokens.visible %>
         <%= render :partial => "access_token" %>
       </tbody>
     </table>
diff --git a/db/migrate/20160413183434_add_redirect_uris_to_developer_keys.rb b/db/migrate/20160413183434_add_redirect_uris_to_developer_keys.rb
index cd3c86f6419..b0ecefca7c0 100644
--- a/db/migrate/20160413183434_add_redirect_uris_to_developer_keys.rb
+++ b/db/migrate/20160413183434_add_redirect_uris_to_developer_keys.rb
@@ -16,7 +16,7 @@
 # with this program. If not, see <http://www.gnu.org/licenses/>.
 
 class AddRedirectUrisToDeveloperKeys < ActiveRecord::Migration[4.2]
-  tag :postdeploy
+  tag :predeploy
 
   def change
     add_column :developer_keys, :redirect_uris, :string, array: true, default: [], null: false
diff --git a/db/migrate/20180920160456_add_internal_service_to_developer_keys.rb b/db/migrate/20180920160456_add_internal_service_to_developer_keys.rb
new file mode 100644
index 00000000000..2eb8d0ac5b6
--- /dev/null
+++ b/db/migrate/20180920160456_add_internal_service_to_developer_keys.rb
@@ -0,0 +1,24 @@
+#
+# Copyright (C) 2018 - present Instructure, Inc.
+#
+# This file is part of Canvas.
+#
+# Canvas is free software: you can redistribute it and/or modify it under
+# the terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, version 3 of the License.
+#
+# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along
+# with this program. If not, see <http://www.gnu.org/licenses/>.
+
+class AddInternalServiceToDeveloperKeys < ActiveRecord::Migration[5.1]
+  tag :predeploy
+
+  def change
+    add_column :developer_keys, :internal_service, :boolean, default: false, null: false
+  end
+end
diff --git a/spec/models/access_token_spec.rb b/spec/models/access_token_spec.rb
index 33e4b3571bd..fd4ba6f5e1c 100644
--- a/spec/models/access_token_spec.rb
+++ b/spec/models/access_token_spec.rb
@@ -167,6 +167,27 @@ describe AccessToken do
     end
   end
 
+  describe "Third party" do
+    before do
+      @trustedkey = DeveloperKey.new(internal_service: true)
+      @trustedkey.save!
+
+      @untrustedkey = DeveloperKey.new()
+      @untrustedkey.save!
+
+      @trusted_access_token = AccessToken.new({developer_key: @trustedkey})
+      @trusted_access_token.save!
+
+      @third_party_access_token = AccessToken.new({developer_key: @untrustedkey})
+      @third_party_access_token.save!
+    end
+
+    it "only displays integrations from untrusted developer keys" do
+      expect(AccessToken.visible.length).to eq 1
+      expect(AccessToken.visible.first.id).to eq @third_party_access_token.id
+    end
+  end
+
   describe "token scopes" do
     let_once(:token) do
       token = AccessToken.new