Token Expiration Time Limit in Confidential Application

Hello experts,

I am implementing OAuth as the authorization method for integrating Fusion App endpoints by configurating Confidential Application in OCI. There are 2 question I want to confirm:

1. In the Confidential App setting (server app), there is a setting to change the Access token expiration (seconds), where the default value is 3600 seconds. However, I would like to know what is the lower and upper limit of the value that can be input in this field. Same with the Refresh token expiration field
   
2. In the Confidential App setting (client app), there is an option to re-generate the client secret. Is it true that there is no expiry time for this client secret?