This helps limit the actions available to an attacker should they gain access. • Using Short-Lived Access Tokens: Keep access token life spans between five and 15 minutes.