Token lifetime is how long an access token remains valid before it expires. Access tokens are temporary credentials used by applications and users to call APIs or reach protected services without sending a password every time. When the lifetime is short, the token becomes useless quickly if it is copied or stolen.
This matters in cyber security because leaked tokens can provide immediate access if they are still active. Attackers often search source code, logs, browser storage, or build artifacts for tokens that can be reused before expiration. Defenders reduce risk by setting shorter lifetimes, using refresh tokens carefully, and revoking tokens when secrets are exposed. In incidents involving committed credentials, a long token lifetime can turn a disclosure into live access, while a short lifetime limits the window for abuse.