# Symptom
A previously working session now fails verification. You need to know whether to let the client refresh, send the user to sign in, or investigate an admin action.
# Confirm the cause
1. Read the token's `exp` claim. If the current time is past `exp`, the token simply expired. Clerk session tokens are short-lived (about a minute) and the frontend SDK auto-refreshes them, so expiry alone is normal. Constant expiry on the backend usually means the client stopped refreshing (suspended tab, SDK not loaded).
2. If `exp` is still in the future but verification fails, the SESSION is revoked or the user is banned/locked. Check the session status through the Backend API (list the user's sessions and look at their status). Revoked sessions stay revoked; no refresh will revive them.
3. If every session for the user died at the same moment, check the user record: banning a user revokes all of their sessions and blocks new sign-ins. Locking behaves similarly for the lock duration.
# Fix
- Expired: make sure the frontend SDK is loaded and refreshing; nothing to do server-side.
- Revoked: send the user through sign-in again. Do not retry the old token.
- Banned/locked: that is an admin decision; surface "contact support", not a retry loop.
# Verify
After re-sign-in, the new session verifies. If sessions keep dying, look for an automated revoke (password change with sign-out of other sessions, or a ban) rather than a token bug.