Not sure what the upper limit, but you can make as many seconds as desired. The token is just a jwt with an expiration “time”. At some point though you might as well have a public bucket (only difference is url does not expire) with a hard to guess name.