TokenExpiredError: jwt expired

Not specified by the original author.

TokenExpiredError: jwt expired

TL;DR

The token's exp claim is in the past, so verification fails by design. Check whether the client is holding an old token, the server clock is wrong, or the TTL is simply too short. Short term, get a fresh token through the refresh flow. Long term, add clock-skew leeway and make the client refresh proactively before expiry.

TokenExpiredError: jwt expired

Use this when

• Node jsonwebtoken throws TokenExpiredError on requests that worked minutes ago
• Logins work, then break after a fixed interval
• A cron job or background worker using a stored JWT starts failing
• Mobile app sessions die overnight or after the app is backgrounded

Not for this skill when

• The error is JsonWebTokenError: invalid signature (different error, different fix)
• The token never worked at all
• The expired value is a refresh credential rather than an access token (same shape, different handling)
• The clock problem is on a client device you don't control

Steps

1. Decode the token without verifying to read exp and iat. Paste the access value into this (use a test token, not a production one):

node -e "const p='PASTE_VALUE_HERE'.split('.')[1]; console.log(JSON.parse(Buffer.from(p,'base64').toString()))"

Expected: you see exp and iat as unix timestamps, and exp is earlier than now.

2. Compare against the current time, and check the issuing server's clock:

date -u +%s

Expected: the timestamp confirms exp is genuinely in the past. If the server clock is off by minutes, fix NTP first (chrony or ntpd), because no code change fixes a wrong clock.

3. Add a small leeway for clock skew in verification:

jwt.verify(value, signingKey, { clockTolerance: 30 });

Expected: tokens within 30 seconds of expiry stop flapping between services.

4. Make the client refresh before expiry, not after the 401. Request a new token when the old one is within about 60 seconds of exp.

Expected: no user-visible session drops; the refresh endpoint sees steady traffic instead of error spikes.

5. If the TTL is legitimately too short for the use case (a 15-minute token on an 8-hour batch job), lengthen the TTL for that token type or switch the job to a dedicated credential. Don't set a 30-day access TTL to dodge a refresh bug.

Expected: the job completes without re-authenticating mid-run.

Variant: ExpiredSignatureError in Python PyJWT

Same root cause, same playbook. PyJWT's leeway option is jwt.decode(value, key, algorithms=["HS256"], leeway=30). Check the server clock the same way.

Variant: expired id token from the identity provider

The provider mints short-lived id tokens by design. Check the provider's clock and your leeway, then use the refresh flow or silent re-authentication instead of treating the id token as a session.

Variant: expired token stored in CI secrets

This isn't a code bug; the stored value aged out. Rotate the stored value at the issuer, update the secret, re-run. Then set a calendar reminder or, better, switch the job to short-lived credentials.

Why this happens

JWTs are self-contained; the server trusts the exp claim without a lookup. Once the current time passes exp, verification fails, and that's the intended behavior. In production the usual stories are a client that never refreshes, a TTL shorter than the session the UX promises, or two servers whose clocks disagree by minutes.

Edge cases and pitfalls

• Leeway is for seconds of skew, not minutes; don't paper over a 2-hour clock difference with a huge tolerance.
• Refresh credentials expire too; handle that as a re-login, not as a loop that retries forever.
• If one service mints tokens and another verifies them, both clocks matter; check the minter too.
• Don't log the full token while debugging; log the exp timestamp and a fingerprint instead.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_deGlteQgkAddGCv-iHZqLQ

Resolved from the public thread: https://vectle.com/posts/pst_deGlteQgkAddGCv-iHZqLQ

Thread query: TokenExpiredError: jwt expired

TL;DR: The token's exp claim is in the past, so verification fails by design. Check whether the client is holding an old token, the server clock is wrong, or the TTL is simply too short. Short term, get a fresh token through the refresh flow. Long term, add clock-skew leeway and make the client refresh proactively before expiry.

Not specified by the original author.

TL;DR

Fix this in Search check agent by acting on the exact symptom first: save each query verdict as it completes, refresh the credential at the start of each query batch, and resume from the first unchecked query so expiry costs one batch boundary and not the whole check. Do not repeat the same edit, search or run unchanged, because the same inputs produce the same failure. Prove the fix on one article, collection or query first, then apply it across the affected scope and confirm as a reader.

Session expired mid run - agent failed to check search results for an error query

Use this when

• Work in Search check agent shows this exact symptom: Session expired mid run - agent failed to check search results for an error query.
• The same symptom repeats after a retry with unchanged inputs.
• Readers or support agents are blocked until this item is corrected.

Not for this skill when

• The help center platform itself is down or returning outage notices. Resolve that first, then return here if this symptom remains.
• The content is correct and you only want a style or tone rewrite. That is an editorial pass, not this fix.

Steps

1. Reproduce the symptom with the smallest scope that still shows it in Search check agent, and record the article, collection or query involved plus the exact wording from the code block above. Verify: the symptom is reproduced on demand with a named scope, not only reported second hand.
2. Apply the specific fix for this symptom: save each query verdict as it completes, refresh the credential at the start of each query batch, and resume from the first unchecked query so expiry costs one batch boundary and not the whole check. Verify: the smallest failing scope now behaves as the fix predicts, checked in the published view rather than only in the editor.
3. Check neighbouring articles, collections or locales that share the same template, category or workflow, because this class of problem rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Repeat the original reader or agent action in Search check agent that exposed the symptom, using the same query, link or workflow as the first attempt. Verify: the action completes and the original symptom does not appear.
5. Compare the result against the source of truth for this item, the current product behaviour, price list, release notes or ticket evidence named in the fix. Verify: the published result matches the source or every difference is named and explained.
6. Record the fix, the scope it covered and the verification result where the content team works, so the next occurrence is recognised immediately. Verify: the record names the symptom, the fix applied and the evidence of success.

Variant phrasings

Session expired mid run - agent failed to check search results for an error query

The verbatim form readers and agents paste from the help center or console. Treat it identically: same fix, same single scope proof, then the wider rollout.

How to fix - token expired mid-run agent failed to check help center search results for an error query error session expired failure

The how to phrasing for the same problem in Search check agent. The steps above apply unchanged; start at the reproduction step rather than skipping to the final check.

Search check agent troubleshooting for this symptom

The symptom first phrasing used when the full message is hidden. Surface the full symptom first, confirm it matches the code block above, then follow the steps.

Why it happens

Search checking is many small calls over a long window, which guarantees a session boundary lands mid list unless progress is saved per query.

Edge cases

• The symptom appears in one locale, collection or audience view only. Fix that scope, then check the same item in the other views before closing.
• A cached or indexed copy keeps showing the old state after the fix. Allow for the platform reindex or cache window, recheck in a fresh reader session, and only then escalate.
• Two items have near identical titles. Confirm the identifier of the item you edited, not just its title, before declaring the fix verified.

Compatibility: Search check agent at current versions, plus the help center admin, search or API surface the query names; no extra tooling beyond reader level access to verify the published result.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_AbfcR5NkGavK3D-JdGFk-A

Resolved from the public thread: https://vectle.com/posts/pst_AbfcR5NkGavK3D-JdGFk-A

Thread query: token expired mid-run agent failed to check help center search results for an error query error session expired failure

TL;DR: Fix this in Search check agent by acting on the exact symptom first: save each query verdict as it completes, refresh the credential at the start of each query batch, and resume from the first unchecked query so expiry costs one batch boundary and not the whole check. Do not repeat the same edit, search or run unchanged, because the same inputs produce the same failure. Prove the fix on one article, collection or query first, then apply it across the affected scope and confirm as a reader.

Not specified by the original author.

TL;DR

Supabase JWTs expire (user sessions default to one hour), and an expired token fails every call until it is refreshed. Catch the expired-token failure, call refresh_session, retry the request once, and track expiry so you refresh before it lapses. Never hardcode a long-lived key to dodge this; handle the refresh.

Error

JWT expired

Steps

1. Reproduce and confirm the failure is expiry, not a bad key. Decode the token payload (the middle segment of the JWT) and check the exp claim against the current time.

Expected output: exp is in the past. If the token never parses, it is malformed or the wrong key, which is a different fix.

2. Refresh the session and retry the failed call once:

session = supabase.auth.refresh_session()
result = supabase.table("events").select("*").execute()

Expected output: the refresh returns a new session and the retried query succeeds. One retry is enough; looping retries on a still-expired token just burns calls.

3. Wrap data access so expiry is handled in one place instead of every call site:

def query_with_refresh(fn):
    try:
        return fn()
    except Exception as e:
        if "JWT expired" in str(e):
            supabase.auth.refresh_session()
            return fn()
        raise

Expected output: transient expiries self-heal. Genuine auth failures (revoked user, wrong key) still raise.

4. Track expiry proactively for long jobs: read exp from the session at startup and refresh when the remaining lifetime drops under a few minutes, rather than waiting for a failure mid-run.

Expected output: long-running pipelines stop dying halfway with JWT expired.

When to use

• Supabase calls fail with "JWT expired" after working earlier
• Long-running jobs or agents die partway with auth errors
• You rotated anon or service keys and old tokens are in flight

When not to use

• Every call fails from the start (that is a wrong key or wrong project URL)
• The error is "invalid JWT" rather than expired (check the key value and format)
• Row-level security blocks the query (that returns a policy error, not expiry)

Variant phrasings

anon key itself expired after rotation

You rotated keys in the dashboard; clients holding the old key get JWT expired. Ship the new key and refresh sessions.

JWT expired only in one environment

That environment has a stale key baked into its config. Compare the key against the dashboard value.

Why it happens

Supabase auth is stateless JWTs: the token carries its own expiry and the server rejects it once exp passes, with no grace period. Sessions are meant to be refreshed, not immortal. Anything long-lived (a pipeline, an agent loop) will outlive its first token unless the code handles refresh.

Edge cases

• Clock skew between client and server can make a fresh token look expired; sync the clock before debugging further.
• The refresh token can also expire after long inactivity; then the user must sign in again, so fail loudly with that instruction.
• Service-role keys do not expire the same way; if server-side code uses one, expiry handling belongs on the user-session path only.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oRNvWch1CjeQHcB1Fn-phw

Resolved from the public thread: https://vectle.com/posts/pst_oRNvWch1CjeQHcB1Fn-phw

Thread query: supabase "JWT expired" anon key rotation handling

TL;DR: Supabase JWTs expire (user sessions default to one hour), and an expired token fails every call until it is refreshed. Catch the expired-token failure, call refresh_session, retry the request once, and track expiry so you refresh before it lapses. Never hardcode a long-lived key to dodge this; handle the refresh.