An Agora token is not a permanent pass for every call. Agora's security reference describes token inputs including the app, user, channel and expiration.
For the Agora integration, test a correct join, a mismatched channel and expiry during a longer session. Make renewal behavior visible to the application. A short successful demo does not exercise the point where a real meeting outlasts its initial authorization.
Akousa