Appear on the token display thirty days prior to expiration.

Are programmed into a token record at the time of manufacture.

Vary according to the date set by the administrator when assigning the token.

Depend on the clock in the Authentication Agent to determine if the token is active.