True or false? Private app tokens expire after six hours.

In the HubSpot Data Integration certification, this statement is False because private app access tokens are designed to be long-lived and do not have an automatic expiration time like standard OAuth access tokens (which typically expire after 30 minutes). While public apps using OAuth require a refresh token to generate new access tokens periodically, a private app token remains valid indefinitely unless a Super Admin manually rotates or revokes it. HubSpot does recommend a security best practice of rotating these tokens every six months to minimize the risk of long-term exposure, but there is no forced six-hour expiration period, making them an ideal solution for internal, server-side integrations that require consistent, uninterrupted access to a single HubSpot portal.