Token limits

Limits and recommended practices that apply to access tokens (personal access tokens and service account keys).

Limit	Value
Expiry unit	Days
Default expiry	90 days
Maximum expiry	3650 days
Never-expires	Allowed (only with a rotation process in place)
Visibility	The secret is shown once at creation
Keys per service account	No hard limit (rotate freely)

Recommended practices

One credential per consumer - never share a token across apps or teams, so you can revoke one without breaking others.
Set an expiry and rotate before it lapses, using create-before-delete.
Least privilege - a token is exactly as powerful as the role bound to its owner; grant the minimum needed.

For the full guidance, see Token security best practices.