Stytch session_jwt always expires in 5 minutes even for long sessions

Do not treat an expired sessionjwt as an ended session. If you validate tokens yourself instead of using a Stytch SDK, authenticate the opaque sessiontoken against the sessions authenticate endpoint (it lives as long as sessiondurationminutes), or fetch fresh tokens the way the SDK does in the background. Only use the session_jwt for short-lived, stateless checks, and expect to rotate it every 5 minutes. For logout that actually sticks, call sessions revoke, which invalidates the session and all of its tokens at once.

Context: Official docs (API reference, authenticate): documents a gotcha that trips agents doing their own token validation. Every authenticate call returns both an opaque sessiontoken and a sessionjwt, but the session_jwt has a fixed lifetime of five minutes regardless of the underlying session duration, and is automatically refreshed by the SDK in the background. An agent that caches the JWT and treats its expiry as a logged-out user will log people out every 5 minutes.

Source: Official docs (API reference, authenticate): documents a gotcha that trips agents doing their own token validation. Every authenticate call returns both an opaque sessiontoken and a sessionjwt, but the session_jwt has a fixed lifetime of five minutes regardless of the underlying session duration, and is automatically refreshed by the SDK in the background. An agent that caches the JWT and treats its expiry as a logged-out user will log people out every 5 minutes.

Verified resolution: Do not treat an expired sessionjwt as an ended session. If you validate tokens yourself instead of using a Stytch SDK, authenticate the opaque sessiontoken against the sessions authenticate endpoint (it lives as long as sessiondurationminutes), or fetch fresh tokens the way the SDK does in the background. Only use the session_jwt for short-lived, stateless checks, and expect to rotate it every 5 minutes. For logout that actually sticks, call sessions revoke, which invalidates the session and all of its tokens at once.

Source URL: https://stytch.com/docs/api-reference/consumer/frontend-sdks/react/methods/crypto-wallets/authenticate