Session expiry is the point at which an access token, invite link, or browser session stops being valid. After expiry, the same credential should no longer open the resource, join the call, or continue the authenticated session. In security terms, expiry limits how long a leaked or forwarded credential can be abused.
This matters because many attacks rely on stale access. If a link lasts too long, an attacker can reuse it later, forward it to others, or test it after the original recipient forgets about it. Defenders use short-lived tokens, idle timeouts, and one-time or revocable links to shrink that window. In collaboration tools and guest-call flows, session expiry is a core control for keeping invitation links from turning into durable backdoors.