The token has a max lifetime of 60 seconds. And a secret key (to generate the token) can be changed/revoked per domain in General Preferences if it is compromised