> Source: [/docs/accounts/access-keys/expiry](https://tempo.xyz/developers/docs/accounts/access-keys/expiry.md) > Section: [Accounts](https://tempo.xyz/developers/docs/accounts.md). Create accounts, set up signing methods, policies, access keys, key rotation, and fees, and follow guides for users, automations, agents, and teams. > [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md) > Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation. > If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly. # Expiry Makes an access key stop working at a set time, so a forgotten or leaked key ends on its own. ## Overview An expiry is the time an [access key](https://tempo.xyz/developers/docs/accounts/access-keys) stops working. It's one of the key's three bounds, with [spending limits](https://tempo.xyz/developers/docs/accounts/access-keys/spending-limits) and [scopes](https://tempo.xyz/developers/docs/accounts/access-keys/scopes). You set it when you authorize the key, and you can't extend it later. Tempo checks the expiry against block time (the current block's timestamp), not your server's clock. Once block time reaches the expiry, Tempo rejects every transaction the key signs with [`KeyExpired`](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#error-keyexpired). The key's remaining limit reads as zero. ## Set an Expiry Pass `expiry`, a Unix timestamp in seconds, when you [authorize the key](https://tempo.xyz/developers/docs/accounts/access-keys#authorize-an-access-key) with Viem's [`accessKey.authorize`](https://viem.sh/tempo/actions/accessKey.authorize). A key without `expiry` never expires. The `Expiry` helpers in `viem/tempo` return a timestamp relative to now, such as `Expiry.days(30)` or `Expiry.hours(1)`. Use the shortest window the holder needs. A shorter expiry ends a forgotten or leaked key sooner. | Holder | Expiry | | --- | --- | | A one-off task | Hours | | A device | 30 days | | A backend | 90 days | ## Renew a Key Tempo never authorizes the same key address twice for an account. To renew, authorize a new key before the old one expires. Read the old key's `expiry` with `client.accessKey.getMetadata({ account, accessKey })`. Before that time: 1. Generate a new key where the holder signs. 2. Have the signers, or an admin key, authorize it with a new expiry. 3. Switch the holder to the new key. 4. [Revoke](https://tempo.xyz/developers/docs/accounts/access-keys/revocation) the old key if it hasn't expired yet. Until the old key expires or is revoked, both keys can spend, each up to its own limit. To keep one budget, authorize the new key with a limit of what the old key has left. [Raise it](https://tempo.xyz/developers/docs/accounts/access-keys/spending-limits#change-a-spending-limit) once the old key is revoked. If the holder can pause, revoke the old key first instead. ## Limits * An expiry at or before the current block time reverts with [`ExpiryInPast`](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#error-expiryinpast). * Admin keys can't have an expiry. * Changing an expired key's limit with `updateLimit` reverts with [`KeyExpired`](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#error-keyexpired). Specification: [Account Keychain key expiry](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#key-expiry). ## Related [Access Keys](https://tempo.xyz/developers/docs/accounts/access-keys): Covers how access keys sign for an account within their bounds. [Revocation](https://tempo.xyz/developers/docs/accounts/access-keys/revocation): Covers how to end a key before its expiry. [Spending Limits](https://tempo.xyz/developers/docs/accounts/access-keys/spending-limits): Covers how much of each TIP-20 token a key can spend.