Signup tokens are current valid forever. Tokens should expire though to reduce the chance of brute forcing deprecated tokens.