Validation rules for Personal Access Token (PAT)

[Kai Gao]

Hi team,

   For a product that we are building, we take PAT as an input from our customers and use it to call customer's Confluence Server URL. For security reasons, we need to run some basic validation rules on the PAT provided by customer, as it's an external input. So, I'd like to know if there are any regex rules / patterns and any length limit on a PAT. I've referred the Confluence documentation on PAT, but couldn't find the same, hence asking here. Thanks for the help!

Thanks!