# Credential hygiene: Hydra token TTL tuning + key metadata

Two sub-hour pieces: (1) review/tune Hydra's `client_credentials` access-token TTL in `hydra.values.yaml` (default vs what agents actually need — shorter is safer now that keys re-mint freely); (2) enrich API-key metadata in the m3 Core — created-by (subject from `api.IdentityFrom`) and last-used timestamp, surfaced in list responses (and later the m8 dashboard list).
