# Enforce Access Token Expiry Policies in Pulumi Cloud

DevFeed: [Enforce Access Token Expiry Policies in Pulumi Cloud](<https://devfeed.tech/articles/enforce-access-token-expiry-policies-in-pulumi-cloud-18985.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/access-token-expiry-policy/>)

Author: Devon Grove

Published: 2026-07-27T00:00:00Z

Content type: release

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Cloud](<https://devfeed.tech/topics/cloud.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [features](<https://devfeed.tech/tags/features.md>), [organization](<https://devfeed.tech/tags/organization.md>), [policy](<https://devfeed.tech/tags/policy.md>), [product](<https://devfeed.tech/tags/product.md>), [rotation](<https://devfeed.tech/tags/rotation.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

Pulumi Cloud organizations can enforce maximum expiry periods for access tokens. Administrators set a cap, and tokens without an expiration or with too much remaining lifetime are rejected when used against the organization.

## Source excerpt

Pulumi Cloud organizations can now enforce a maximum expiry on the access tokens used against them. Organization admins can set a cap in days, and from that point on, personal, organization, and team tokens operating on resources in the org must carry an expiration within the cap for requests to succeed. Tokens that never expire, or that have too much lifetime remaining, get rejected with an error that tells the user exactly how to regain access. Why cap token lifetimes Many organizations already have a credential rotation policy that says tokens must expire, but until now, Pulumi Cloud could only recommend an expiry at creation time. Nothing stopped a member from creating a never-expiring personal token, and nothing aged out the long-lived tokens created before your policy existed. That gap matters because a leaked token is only as dangerous as its remaining lifetime. A token that never expires is a standing liability. By adding support for access token expiry policies, Pulumi Cloud now closes the gap at the platform level. Once you've set the cap, Pulumi Cloud enforces it immediately for your organization, including for tokens that already exist. How it works In your organization's settings, navigate to Settings > Access Management > Other and scroll to Access token expiry policy: You can also get there from the Access Tokens tab, where a banner shows whether a policy is in effect -- select Edit policy: The policy is a single number: the maximum expiry, in days, for tokens used against your organization. Compliance is checked on every request, and a token complies when both of these are true: It has an expiration date. Never-expiring tokens violate any policy. Its remaining lifetime -- the time between now and its expiration -- is within the cap. Because compliance is based on remaining lifetime rather than the expiry chosen at creation, the policy is pragmatic about existing credentials: a token created a year ago with a two-year expiry becomes compliant once it has