---
id: w4/m13/t001
title: Hydra client_credentials TTL review/tune; decision recorded in docs/ADR012-auth.md
worker: worker4
status: done
estimate: 25m
depends_on: []
---

## Objective

API-key tokens currently live as long as Hydra's default `client_credentials` access-token TTL. Now that keys re-mint tokens freely (the m3 flow), a shorter TTL shrinks the blast radius of a leaked token at near-zero UX cost. Review the default, pick a deliberate value (agents' longest realistic single-session use as the floor), set it in values, and record the decision + rationale in docs/ADR012-auth.md.

## Context

- `deploy/gitops/base/values/hydra.values.yaml` (`ttl.access_token`); Hydra token minting flow in docs/ADR012-auth.md.
- Consider the MCP/agent session pattern (w4/m9's OAuth clients share Hydra) — verify the TTL knob scopes to `client_credentials` and doesn't shorten flows that need longer.

## Steps

1. Check the current effective TTL (values + Hydra default); pick and set the new value.
2. Verify live: mint a token, introspect, confirm `exp` reflects the new TTL; agents still work after expiry (transparent re-mint).
3. docs/ADR012-auth.md paragraph.

## Files

- `deploy/gitops/base/values/hydra.values.yaml`
- `docs/ADR012-auth.md`

## Acceptance criteria

- [x] Introspected token expiry matches the tuned TTL; an expired token re-mints without user action; decision documented.

## Out of scope

- Refresh-token/consent-flow TTLs (w4/m9 clients) unless the knob forces a shared decision — then document it.
