Validity of Android Management APIs WebTokens

Offhand I think a few hours. The approach I see taken normally is to generate these on demand as customers click around your solution

Based on general practices and previous implementations, the web token created by the createWebToken method typically has a short expiry time, often ranging from a few minutes to an hour. This is to ensure security and reduce the risk of token misuse.