---
title: How to set and manage credential maximum duration
description: This page shows you how to configure and manage a maximum time-to-live for API keys and console sessions in your Organization.
dates:
  validation: 2026-01-05
  posted: 2026-01-05
---
import Requirements from '@macros/iam/requirements.mdx'


For increased security in your Organization, you can define a **maximum duration** for credentials (console sessions and API keys) created within it. Limiting credential lifetime reduces the risk of leaked or compromised credentials remaining valid at the time of exposure.

<Message type="important">
  The security measures described on this page apply to credentials of both [Owners](/iam/concepts#owner) and [IAM members](/iam/concepts#members).
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization

## How to set a maximum duration for API keys

You can define a maximum duration for all API keys created inside your Organization. By default, API keys do not expire unless the creator specifies an expiration date [when creating them](/iam/how-to/create-api-keys).


<Message type="note">
 The maximum duration applies to **all new API keys created in the Organization** including those of Owners, Members, and Applications.
</Message>

1. Go to your [security](https://console.scaleway.com/settings/security) settings.
2. Scroll to the **Credential limitations** section.
3. Click **Set up API keys duration*. A pop-up appears.
4. Choose the maximum duration allowed for API keys in the Organization.
    <Message type="important">
       Setting a maximum duration does **not** affect existing API keys. To enforce a new time-to-live policy on older API keys, you must either:
       - Add an expiration date to any API key that does not have one
       - Revoke and recreate an API key if it already has an expiration date that does not comply with the new maximum duration 
       
       It is **not possible to modify the expiration date** of an existing API key.
    </Message>
5. Click **Confirm**.

The maximum duration now applies to all *newly created* API keys. Users must specify an expiration date that complies with this limit. Any API key created with no expiration date or a duration exceeding the limit will result in an error.

## How to edit or remove a maximum duration for API keys

1. Go to your [security](https://console.scaleway.com/settings/security) settings.
2. Scroll to the **Credential limitations** section.
3. Click **Set up API keys duration*. A pop-up appears.
4. In the pop-up, you can:  
   - Select a new maximum duration  
   - Remove the limitation entirely  
   <Message type="important">
     As with the initial setup, modifying the maximum duration does not retroactively affect existing API keys.
   </Message>
5. Click **Confirm**.

## How to define a maxium duration for console sessions

A console session corresponds to the period during which a user is logged in to the Scaleway console and able to perform actions (view, create, manage resources). Sessions end when the user logs out, or automatically when the maximum duration is reached.
All console sessions have a maximum duration. **By default, if not manually configured, the maximum duration is 30 days.**

<Message type="information">
  The maximum duration applies to console sessions of both Owners and Members.
</Message>

1. Go to your [security](https://console.scaleway.com/settings/security) settings.
2. Scroll to the **Credential limitations** section.
3. Click **Edit** in the **Console session maximum duration** section. A pop-up appears.
4. Choose the maximum allowed duration for console sessions in your Organization.  
   <Message type="important">
     This setting affects **all console sessions**, including already active ones.  
     The change may take up to one hour to fully apply.
   </Message>
5. Click **Confirm**.