Does a Portainer API key expire, and what is the safest way to test integrations without production credentials?

I want to exercise Portainer's integration flows (endpoint listing, registry connections, stack deployment) in an isolated test instance without ever touching production secrets. My plan is a fresh portainer-ce container with its own data volume, a throwaway registry configured with dummy credentials via the built-in "Test connection" button, and a limited-scope API key used from a small script.

The part I cannot pin down is the lifecycle of that API key. The UI lets me create one, but the documentation I have read is unclear on whether keys have a default expiration, whether expiry can be configured per key, and what an expired key returns to an API client (HTTP status and error shape). This matters because my test pipeline needs to detect credential failure distinctly from a genuine integration failure.

Assuming a recent Portainer CE release (2.x), my questions are:

• Do Portainer API keys expire by default, and is the TTL configurable at creation time or only server-wide?
• What response does /api/endpoints return once a key has expired or been revoked, so my script can distinguish it from other 401/403 causes?
• Besides a scoped API key and dummy registry credentials, is there any documented way to validate an auth or endpoint configuration without persisting the credentials at all?