Expiry date for API tokens not honored

[williamhatcher]

Describe the bug The expiry date input is ignored when creating or modifying an API token.

To Reproduce Steps to reproduce the behavior:

1. Create a token, (I chose API Token)
2. Ensure "Expiring" is checked
3. Change the date or time in the "Expires on" field to a valid date in the future
4. Save
5. Observe that the "Expiry date" column shows a date 30 minutes in the future regardless of date selected earlier.

Expected behavior The expires on field in the table shows the selected date/time (if valid)

Screenshots If applicable, add screenshots to help explain your problem.

Logs Output of docker-compose logs or kubectl logs respectively

Version and Deployment (please complete the following information):

• authentik version: [2025.2.4]
• Deployment: docker-compose

Additional context Add any other context about the problem here.

[williamhatcher]

Added authentik version and deployment.

[rissson]

May not be a bug since the original implementation purposefully prevented tokens with API purpose to have their expiration overridden, but just pinning this issue. We're discussing this internally and will get back here with next steps.

[captainzonks]

I'm experiencing this myself. It breaks API access from other services when the token is stored as a Docker Secret and used as an environment variable, like Homepage's Authentik widget, as an example. A token set for an expiration of, say, 12/31/2025 11:59 PM, is just rotated constantly and no longer valid for these services to use.