I need a maximum allowed lifetime for API tokens. Being able to set an expiry far in the future, like 2050, creates long-lived credentials that are hard to control if ownership is lost.