Users can generate personal API credentials (a client ID and secret) from the Credentials section. The access tokens they produce last about 3 hours, but the client secret has no documented expiry. A leaked or forgotten secret can keep minting new tokens indefinitely, and it keeps working after a session ends, outside the controls on UI sign-in (session limit, inactivity timeout, MFA).

Request:

Let users set an expiry date when creating personal credentials, with sensible presets (for example 7, 30, 90 days) and a maximum.

Expired credentials stop working automatically.

Show the creation date, expiry date and last-used date to the owner.

Notify the owner (email or webhook) before expiry.

Allow renewal without losing the credential's identity or history.

Why it matters: most enterprise security policies require credentials to have a bounded lifetime. Today the only way to bound a personal secret is manual rotation, which depends on each user remembering.