The AES_ENCRYPT function now supports a new expires_in parameter that can be set to the number of seconds before AES_DECRYPT will reject decrypting the ciphertext and log an error. Expiration support is only available when using mode:"aead".

AES_ENCRYPT("plaintext", CREDENTIALS.your_secret, mode: "aead", expires_in: 60)