Long enough to authenticate the node into the Tailnet. Short enough to revoke itself before the Agent can use it.