Configuring the token expiry time

Access tokens and refresh tokens expire after a time set in rest.ini [OAuthSettings]:

# settings/override/rest.ini.append.php
[OAuthSettings]
# lifetime of an access token in seconds (default: one hour)
TokenTTL=3600
# lifetime of a refresh token in seconds from the refresh that issued it (default: 30 days); 0 = no expiry
RefreshTokenTTL=2592000

A new value applies to tokens issued from then on. After the change, clear the INI cache (php bin/php/ezcache.php --clear-tag=ini), reload PHP-FPM, and restart Exponential Velocity if you use it.

Personal API keys have their own expiry, chosen by the user when the key is made: [ApiKeySettings] ExpiryChoices[] (7, 30, 90, 365 days or never), DefaultExpiryDays=90, MaxExpiryDays=365.