This object, 1 to 1096 days, defines how long an automatically generated encryption key remains valid before the system rotates it, spanning from a single day up to roughly three years. An admin using automaticKeyGeneration would tune this to balance security hygiene against the overhead of frequent key changes. The default is 7 days, meaning a freshly generated key on a link is replaced roughly once a week.