diff --git a/internal/api/cans.go b/internal/api/cans.go
index b609159..6b0488e 100644
--- a/internal/api/cans.go
+++ b/internal/api/cans.go
@@ -40,6 +40,12 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, 400, "invalid expires_in")
 			return
 		}
+		// #60: clamp at the API boundary like the pastes API does -
+		// reject zero/negative and durations past the 1-year UI cap.
+		if !store.ValidExpiry(d) {
+			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
+			return
+		}
 		t := now + int64(d.Seconds())
 		expiresAt = &t
 	}