Follow up q would be what is the recommended token expiration time frame? we've got ours set at 4 weeks rn

From a security standpoint, 4 weeks is the recommended timeout, but you can set longer sessions based on your use case.