Tags on the sites are, at most, 35 characters.
Permitted characters are a-z 0-9 + # - .
However, this is not part of the API contract insofar as if the site definition of a tag changes so will the API's. It is advisable, for correctness, to have a code path to handle tags > 35 characters in length. Simplest would be to truncate them.