Constant ACCESS_TOKEN_TTL 

pub const ACCESS_TOKEN_TTL: Duration;

Duration for which a freshly minted access token remains valid.

A token is only needed for a client’s very first request: a successful auth hands back a session cookie that carries the session from then on (browsers persist it, and Braid persists its per-camera cookie jar to disk). Keeping the token short-lived bounds the window in which a token leaked via a URL (terminal scrollback, log files, a photographed QR code) can be replayed.