Currently the different types of token (Confirm Email/Password Reset/Change Email) use the same shared DataProtectorTokenProvider named "Default" which in turn all share the same DataProtectionTokenProviderOptions. This means you are unable to configure the lifetime of each type of token separately. Ideally I would like to be able to set the Password Reset to something like 4 hours and the Confirm Email token to 7 days.

I believe I can get around this by subclassing DataProtectorTokenProvider and DataProtectionTokenProviderOptions, and setting the appropriate name via IdentityOptions.Token.EmailConfirmationTokenProvider but it is far from a pretty solution.