Zegnatsknebel: I saw you added a TTL question to autoauth. I am wondering if this is up to autoauth to solve, or if we should look into introducing this as a separate spec? I feel like different people have at different times asked about expiring tokens and the possibilities for refresh tokens
