Currently, the one-time login link lasts for as long as the plugin is active. We should probably expire the link at some point.