I’m using the following endpoint, which correctly returns reactivation link and token,
/api/v1/users/ ${userId} /lifecycle/reactivate
what is the expiration time for this token? can it be configured?
According to this article the activation token is valid for 1 day by default - However it is configurable. The token lifetime gets set by the Activation emails are valid for setting in your Org.