Extend Drupal 6 "form_token" & "form_build_id"
TL;DR: Those values will not expire if


you use the same user to log in to the site
the PHP session is not expired
Drupal finds in its cache the form array associated with "form_build_id."


The token used for "form_token" is the one created using with the following function call: drupal_get_token($form['#token']); the only value that changes in that function call, for the same form, is session_id() which is invoked from drupal_get_token().

function drupal_get_token($value = '') {
  $private_key = drupal_get_private_key();
  return md5(session_id() . $value . $private_key);
}


The value returned from drupal_get_private_key() is unique for each Drupal site; the only way to make it change is to delete the Drupal variable "drupal_private_key" that is never deleted (if there isn't a third-party module that delete it), but it is initialized when Drupal is installed. The value returned by session_id() is the same each time drupal_get_token() is called, if the logged in user is the same, and the PHP session has not yet expired.

As for the value of "form_build_id," its value is totally random, initialized from drupal_prepare_form() using the following code:

  if (isset($form['#build_id'])) {
    $form['form_build_id'] = array(
      '#type' =&gt; 'hidden', 
      '#value' =&gt; $form['#build_id'], 
      '#id' =&gt; $form['#build_id'], 
      '#name' =&gt; 'form_build_id',
    );
  }


$form['#build_id'] is initialized from the following code in drupal_get_form():

  $form_build_id = 'form-' . md5(uniqid(mt_rand(), TRUE));
  $form['#build_id'] = $form_build_id;


As you are passing the value of "form_build_id," and "form_id" in the POST data, then the following code is executed (see drupal_get_form()):

if (isset($_POST['form_id']) &amp;&amp; $_POST['form_id'] == $form_id &amp;&amp; !empty($_POST['form_build_id'])) {
  $form = form_get_cache($_POST['form_build_id'], $form_state);
}


If the cache contains the form, then "form_build_id" is not generated again.