Back to error codes
ERROR TokenExpiredError
JWT TokenExpiredError
OAuth Error
The JWT has passed its expiration time (exp claim).
Root Cause
The token's exp claim is in the past. Tokens expire to limit the window of misuse if stolen.
How to Fix
Implement a token refresh flow: use a short-lived access token (15 min) and a long-lived refresh token (7 days). Refresh the access token before it expires.
Quick Summary
JWT expired. Implement a refresh token flow: short-lived access tokens (15 min) + long-lived refresh tokens (7 days). Refresh before expiry to avoid interrupting the user.
Key Takeaways
Key Takeaways
- Access tokens should be short-lived (15 min to 1 hour)
- Refresh tokens are long-lived (7-30 days) and used to get new access tokens
- Implement silent refresh: refresh the token before it expires
- Store refresh tokens securely (httpOnly cookie, not localStorage)
Use Cases
When to use it
- User session expired after inactivity
- Access token expired during a long operation
- Refresh token also expired (user must log in again)
Watch out
Common Mistakes
- Using long-lived access tokens, short expiry limits damage if a token is stolen
- Storing refresh tokens in localStorage, use httpOnly cookies instead
FAQ
TokenExpiredError JWT TokenExpiredError, Frequently Asked
How do I implement silent token refresh?
Set a timer to refresh the access token 1 minute before it expires. On 401 responses, attempt a refresh and retry the original request.
Still having issues?
Check your network logs or use our developer tools to inspect headers, decode tokens, or validate your requests.