[Request]: Create Transfer Tokens with lifespan of 1 day as only option?

[pellyadolfo]

Summary

By security reasons we need ability to create Transfer Tokens for 1 day, and forbid any other lifespan options. Is possible to customize lifespans for Transfer Tokens? (current options are 7 / 30/ 90 days and unlimited but they are hardcoded).

Why is it needed?

Security reasons

Suggested solution(s)

export or externalize TRANSFER_TOKEN_LIFESPANS on https://github.com/strapi/strapi/blob/develop/packages/core/admin/server/src/services/constants.ts#L52 so we can configure our values

Related issue(s)/PR(s)

No response

[github-actions]

🤖 I've analyzed your question and here's what I found:

Hi there! Thank you for reaching out and sharing this feature request. We appreciate you taking the time to detail your security requirements with the community.

Current Behavior

Currently, Transfer Token lifespans in Strapi are hardcoded to specific options (7 days, 30 days, 90 days, and Unlimited) [constants.ts]. Both the backend validation [token.ts] and the admin panel UI [LifeSpanInput.tsx] strictly enforce this fixed set of values (TRANSFER_TOKEN_LIFESPANS).

Because the backend explicitly validates against these constants, custom durations such as 1 day cannot currently be configured through standard configuration files [token.ts].

---

Suggested Workarounds

While custom lifespans are not yet natively configurable, here are a couple of approaches you can use depending on your workflow:

1. Manual Revocation / Regeneration:
   You can create a token with one of the standard lifespans and manually revoke or regenerate it after 24 hours via the admin panel under Settings > Global settings > Transfer Tokens [Data Management].

2. Automated Token Management via API / Scripts:
   You can programmatically manage your transfer tokens using the internal transfer token services (strapi.service('admin::transfer').token) or the admin REST endpoints to revoke (DELETE /admin/transfer/tokens/:id) tokens on a scheduled 24-hour cron job [token.ts; admin-transfer-token-crud.test.api.ts].

---

Next Steps & Feedback

Because allowing configurable lifespans (or restricting selectable options for compliance) is a feature request that requires modifications to core constants, validation schemas, and UI components, we highly recommend submitting this to the Strapi Feature Request Board:

• Submit your idea on Strapi Feedback so other users can vote on it and help our product team prioritize it.

For further community discussions and questions, feel free to join the Strapi Discord server or check our documentation:

• Strapi Data Management Documentation

If this needs to be tracked directly by the core engineering team for transfer token configuration, pinging @pwizla.

📚 Relevant documentation:

• Data Management
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Admin > Src > Pages > Settings > Components > Tokens - LifeSpanInput.tsx
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Content-types - transfer-token.ts
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Controllers > tests > Transfer - token.test.ts (L10-L147)
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Controllers > tests > Transfer - token.test.ts (L148-L217)
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Controllers > Transfer - token.ts (L1-L122)
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Services - constants.ts
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Services - token.ts
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Services > tests > Transfer - token.test.ts (L54-L189)
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Services > Transfer - token.ts (L1-L116)
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Services > Transfer - token.ts (L256-L396)
• Strapi > Strapi > Blob > Develop > Packages > Core > Admin > Server > Src > Validation > Transfer - token.ts
• Strapi > Strapi > Blob > Develop > Tests > Api > Core > Admin - admin-transfer-token-crud.test.api.ts (L139-L210)
• Strapi > Strapi > Blob > Develop > Tests > Api > Core > Admin - admin-transfer-token-crud.test.api.ts (L211-L337)
• Strapi > Strapi > Blob > Develop > Tests > Api > Core > Admin - admin-transfer-token-crud.test.api.ts (L6-L138)

---

ℹ️ This response was generated automatically. If this doesn't fully answer your question or if you need further assistance, please mention @pwizla in a comment and a human maintainer will help you.

You can also try our interactive AI chat for more detailed assistance.

💡 For feature requests or product feedback, visit feedback.strapi.io.

[pwizla]

Thanks for taking the time to share this!

This looks like a feature request for the Strapi product itself rather than a documentation issue — customizing Transfer Token lifespans would require changes to core constants, validation, and UI components in the Strapi codebase. The best place to track this is the Strapi feedback board at https://feedback.strapi.io — other users can upvote it there to help the product team prioritize it.

If you think this really is a documentation problem and it landed here correctly, just say so in a comment and a maintainer will take another look.

[github-actions]

Closing automatically: this was identified as not being a documentation issue 7 days ago and no one objected. If that was a mistake, comment here and a maintainer will reopen it.