---
title: Timeouts and passwords
slug: configured-commerce/sdk/working-with-timeouts-and-passwords
docTags: 
createdAt: 2026-08-05T19:24:02.434Z
---

When working with Optimizely \{user\["product-name"]}, there are number of options for controlling the specifics related to timeouts and passwords. Some of these options are configurable, while others are not.

## Admin console

### General settings

- Timeout is set to 15 minutes and is not configurable in order to maintain compliance with PA-DSS.
- Users who have the role ISC\_Admin, ISC\_System, or ISC\_Integration, the password expires after 90 days (passwords for website users do not expire).

### Password complexity settings

The settings to control password complexity are found in the Startup.Auth.cs file:

// Configure validation logic for passwords

SecurityOptions.PasswordValidatorOptions = new PasswordValidatorOptions

```csharp
// Configure validation logic for passwords
SecurityOptions.PasswordValidatorOptions = new PasswordValidatorOptions
{
    RequiredLength = 7, 
    RequireNonLetterOrDigit = false, 
    RequireDigit = true, 
    RequireLowercase = false, 
    RequireUppercase = false
};
```

### Website timeout settings

The setting that controls the website timeout for 4.x is found within Startup.Auth.cs.:

```javascript
SecurityOptions.AuthenticationCookieLifetime = Convert.ToInt32(TimeSpan.FromMinutes(20).TotalSeconds);
```

The setting that controls the website timeout for 4.x is found within Startup.Auth.cs.