How long is the user authorization valid?

It's 365 days.
However for cashback API, it is valid for 365days x 10 years. It will be automatically extended each time if user make a payment, grant a balance or re-authorize and the expiration date will be notified via Webhook. Please refer to "expiry" in WEBHOOK for the valid date and time.
Please judge the expiration date by the date part of "expireAt" of the response data of "expiry" of Customer Events Webhook and "Get user authorization status".