Short-lived access tokens are generally recommended to be no longer than 15 minutes, serving as a compensating strategy for when logout notifications are not delivered.