🔐
AB-141
Short-lived access tokens
What it means
Your token endpoint returns expires_in with access tokens.
Why it matters
Short-lived tokens limit the blast radius of token theft. Agents can request new tokens as needed, but a stolen token expires quickly.
✗
What's wrong
Token response: { access_token: 'abc', token_type: 'Bearer' } (no expires_in)
✓
What's right
Token response: { access_token: 'abc', token_type: 'Bearer', expires_in: 3600 }
Check this rule on your site
Enter your URL to check just this one rule (AB-001).