JWT Token Expires Silently Causing Unexpected Logout
Users experience sudden logout after being idle or when making requests. API calls start failing with 401 Unauthorized. The JWT token has expired but the app didn't refresh it before it became invalid.
By default, Supabase tokens expire after 1 hour. Without proper refresh token handling, expired tokens cause failures silently rather than triggering re-authentication flow.
Error Messages You Might See
Common Causes
- autoRefreshToken not enabled in Supabase client config
- No error handling for expired token (401 response)
- Refresh token also expired or missing
- App doesn't check token expiration before making requests
- Network request fails during token refresh
How to Fix It
Enable automatic token refresh and add auth state listener:
const { data: { session } } = await supabase.auth.getSession();
supabase.auth.onAuthStateChange((event, session) => {
if (event === 'TOKEN_REFRESHED') {
console.log('Token refreshed');
} else if (event === 'SIGNED_OUT') {
// Redirect to login
}
});Real developers can help you.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
How long are JWT tokens valid?
By default 1 hour for access tokens. Refresh tokens last 30 days. Configure in Supabase > Authentication > Providers > General.
Should I manually refresh tokens?
No, enable autoRefreshToken in client config and Supabase handles it automatically before expiry.