After a bit of testing I have found that the tokens expire 4 hours after the issued-at claim key (iat). I am not sure why this is, when you can enter an expiration time claim key, but this is currently how it works. Other than this time expiration, I haven't seen any other limitations on validity.