diff --git a/appview/oauth/oauth.go b/appview/oauth/oauth.go
index ea80298e..5a233f3c 100644
--- a/appview/oauth/oauth.go
+++ b/appview/oauth/oauth.go
@@ -224,9 +224,13 @@ func WithService(service string) ServiceClientOpt {
 		s.service = service
 	}
 }
+
+// Specify the Duration in seconds for the expiry of this token
+//
+// The time of expiry is calculated as time.Now().Unix() + exp
 func WithExp(exp int64) ServiceClientOpt {
 	return func(s *ServiceClientOpts) {
-		s.exp = exp
+		s.exp = time.Now().Unix() + exp
 	}
 }
 
@@ -266,6 +270,12 @@ func (o *OAuth) ServiceClient(r *http.Request, os ...ServiceClientOpt) (*indigo_
 		return nil, err
 	}
 
+	// force expiry to atleast 60 seconds in the future
+	sixty := time.Now().Unix() + 60
+	if opts.exp < sixty {
+		opts.exp = sixty
+	}
+
 	resp, err := authorizedClient.ServerGetServiceAuth(r.Context(), opts.Audience(), opts.exp, opts.lxm)
 	if err != nil {
 		return nil, err
diff --git a/appview/repo/repo.go b/appview/repo/repo.go
index cd6475a7..4a50a48c 100644
--- a/appview/repo/repo.go
+++ b/appview/repo/repo.go
@@ -1062,6 +1062,7 @@ func (rp *Repo) Secrets(w http.ResponseWriter, r *http.Request) {
 		r,
 		oauth.WithService(f.Spindle),
 		oauth.WithLxm(lxm),
+		oauth.WithExp(60),
 		oauth.WithDev(rp.config.Core.Dev),
 	)
 	if err != nil {
@@ -1270,6 +1271,7 @@ func (rp *Repo) pipelineSettings(w http.ResponseWriter, r *http.Request) {
 			r,
 			oauth.WithService(f.Spindle),
 			oauth.WithLxm(tangled.RepoListSecretsNSID),
+			oauth.WithExp(60),
 			oauth.WithDev(rp.config.Core.Dev),
 		); err != nil {
 			log.Println("failed to create spindle client", err)