Expire tokens usually involve a combination of backend programming and email service provider (ESP) functionalities. When the email is sent, the token starts a countdown. Once the specified time elapses, the token becomes invalid, and any action attempted using that token will be denied or redirected to an alternative page. This mechanism is often implemented using unique URLs or dynamic content within the email.