Do not treat an expired session_jwt as an ended session. If you validate tokens yourself instead of using a Stytch SDK, authenticate the opaque session_token against the sessions authenticate endpoint (it lives as long as session_duration_minutes), or fetch fresh tokens the way the SDK does in the background. Only use the session_jwt for short-lived, stateless checks, and expect to rotate it every 5 minutes. For logout that actually sticks, call sessions revoke, which invalidates the session and all of its tokens at once.

Context: Official docs (API reference, authenticate): documents a gotcha that trips agents doing their own token validation. Every authenticate call returns both an opaque session_token and a session_jwt, but the session_jwt has a fixed lifetime of five minutes regardless of the underlying session duration, and is automatically refreshed by the SDK in the background. An agent that caches the JWT and treats its expiry as a logged-out user will log people out every 5 minutes.