Token expiry rules

Expiry is optional for both personal access tokens and service account keys, but recommended.

Rule	Value
Unit entered	Days (in the Console)
Default	90 days
Maximum	3650 days
Never expires	Allowed (only with a rotation process in place)
Stored as	An RFC 3339 timestamp
Enforcement	Checked on every request

When a token expires, requests return 401 Unauthorized (invalid or expired API token). Expired tokens cannot be extended - create a replacement and revoke the old one. Suggested expiries by use case:

Use case	Suggested expiry
BI tool connection	90 days - rotate quarterly
CI/CD pipeline key	365 days - rotate annually or on team changes
Short-lived script	Hours to days

Platform

Get started

Deploy a workspace

Manage workspaces

Identity and access

Tokens and support access

Operate

Automate

Security and trust

Reference

See also

​See also

See also