Does the developer token/secret expire? Help Center says ~1h but v1.1 docs don't

[linma21]

Current Situation

I'm building a server-side integration that polls device status via Open API v1.1 (HMAC-SHA256 signature with token + secret + t + nonce). I need to confirm the credential lifetime for unattended operation.

However, according to Step 5 in the official Help Center article (How to Obtain the Token and Key for Developers):

"5. When you log out and back into the SwitchBot app, the token automatically updates with a validity of about 1 hour. To refresh the token, simply log out and log back in."

On the other hand, the Open API v1.1 README mentions no token expiration, relying instead on per-request HMAC-SHA256 signatures with a fresh timestamp (t) and nonce. These two official sources seem to conflict with each other regarding token lifetime.

Questions:

1. In API v1.1, does the token/secret itself expire on a time basis (e.g. ~1 hour)? Or is that "~1 hour" note specific to API v1.0?
2. What events invalidate the token? Only an explicit logout → re-login in the app? Or also: app close, phone power-off/reboot, app update, OS-level session expiry?
3. For unattended server-side polling (no human to re-login periodically), what is the recommended way to keep a stable, long-lived credential?

(Note: I've empirically observed the token staying valid for over an hour, including with the phone powered off. I'd like official confirmation this is expected.)