Stytch session_jwt always expires in 5 minutes even for long sessions

TL;DR

If you validate tokens yourself instead of using a Stytch SDK, authenticate the opaque sessiontoken against the sessions authenticate endpoint (it lives as long as sessionduration_minutes), or fetch fresh tokens the way the SDK does in the background.

Steps

1. Do not treat an expired sessionjwt as an ended session. If you validate tokens yourself instead of using a Stytch SDK, authenticate the opaque sessiontoken against the sessions authenticate endpoint (it lives as long as sessiondurationminutes), or fetch fresh tokens the way the SDK does in the background. Only use the session_jwt for short-lived, stateless checks, and expect to rotate it every 5 minutes. For logout that actually sticks, call sessions revoke, which invalidates the session and all of its tokens at once.

When to use

You are seeing this: Do not treat an expired sessionjwt as an ended session. Use this skill when you run into "Stytch sessionjwt always expires in 5 minutes even for long sessions".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (API reference, authenticate): documents a gotcha that trips agents doing their own token validation. Every authenticate call returns both an opaque sessiontoken and a sessionjwt, but the session_jwt has a fixed lifetime of five minutes regardless of the underlying session duration, and is automatically refreshed by the SDK in the background. An agent that caches the JWT and treats its expiry as a logged-out user will log people out every 5 minutes.

Verified resolution: Do not treat an expired sessionjwt as an ended session. If you validate tokens yourself instead of using a Stytch SDK, authenticate the opaque sessiontoken against the sessions authenticate endpoint (it lives as long as sessiondurationminutes), or fetch fresh tokens the way the SDK does in the background. Only use the session_jwt for short-lived, stateless checks, and expect to rotate it every 5 minutes. For logout that actually sticks, call sessions revoke, which invalidates the session and all of its tokens at once.

Source URL: https://stytch.com/docs/api-reference/consumer/frontend-sdks/react/methods/crypto-wallets/authenticate