◆Error Codes Wiki

JWT Token Expired Error — JSON Web Token Expiration and Renewal

Warning4xx client error

Overview

Fix JWT token expired errors when access tokens pass their expiration time, causing authentication failures in API requests.

Key Details

  • JWT tokens include an 'exp' (expiration) claim as a Unix timestamp after which the token is no longer valid
  • Token expiration is verified server-side; expired tokens are rejected with 401 Unauthorized
  • Access tokens typically expire in 15-60 minutes; refresh tokens last days to months
  • Clock skew between client and server can cause premature expiration detection
  • Expired token errors are normal in healthy systems — the key is handling them gracefully

Common Causes

  • Access token has naturally expired after its configured lifetime
  • Clock skew between the token issuer and the validating server
  • Client-side token caching not checking expiration before sending requests
  • Refresh token flow not implemented, so tokens are never renewed

Steps

  1. 1Implement a token refresh interceptor that catches 401 responses and automatically refreshes the token
  2. 2Check token expiration client-side before making API calls: decode the JWT and compare 'exp' with current time
  3. 3Add a clock skew tolerance (usually 30-60 seconds) in your JWT validation library configuration
  4. 4Store tokens securely (httpOnly cookies or secure storage) and implement silent token refresh in the background
  5. 5Set appropriate token lifetimes: short for access tokens (15-30 min), longer for refresh tokens (7-30 days)

Tags

jwtexpiredtokenauthenticationrefresh

Related Items

http-oauth2-invalid-grant-error

More in 4xx Client Error

http-400-bad-requestHTTP 400 Bad Request — What It Means & How to Fix It
Error
http-401-unauthorizedHTTP 401 Unauthorized — What It Means & How to Fix It
Error
http-402-payment-requiredHTTP 402 Payment Required — What It Means & How to Fix It
Error
http-403-forbiddenHTTP 403 Forbidden — What It Means & How to Fix It
Error
http-404-not-foundHTTP 404 Not Found — What It Means & How to Fix It
Error
http-405-method-not-allowedHTTP 405 Method Not Allowed — What It Means & How to Fix It
Error

Frequently Asked Questions

15-30 minutes is standard for access tokens. Shorter durations are more secure but require more frequent refreshes. Never set access tokens to last longer than 1 hour.