If a site makes it time out after 5-10 minutes that's on them. An hour should be ample time for it to be delivered while offering a decent amount of security a

If a site makes it time out after 5-10 minutes that's on them. An hour should be ample time for it to be delivered while offering a decent amount of security around token availability, especially since it should be revoked as soon as it's been used once.