Credential expiry time should be shorter than the longest expected task: if an Agent normally runs for at most 20 minutes, the credential should be set to expire in 30 minutes.