Supabase Token Expired Error

Supabase error token_expired (token_expired) explained: what it means, why it happens, and how to fix it — with copy-paste code examples.

Error code token_expired Supabase Last verified 2026-08-19

Quick Answer

Refresh the session with supabase.auth.refreshSession() before authed calls. If that does not apply, subscribe to onAuthStateChange and react to TOKEN_REFRESHED / SIGNED_OUT — the full checklist is below.

Error Code

Error code: token_expired
Official name: token_expired
Service: Supabase

What does this error mean?

JWT expired.

Common Causes

How to Fix

  1. Refresh the session with supabase.auth.refreshSession() before authed calls
  2. Subscribe to onAuthStateChange and react to TOKEN_REFRESHED / SIGNED_OUT
  3. Call getSession() at app start instead of reading a cached token
  4. Use the PKCE flow so refresh tokens work in server-side environments
  5. Adjust ACCESS_TOKEN_TTL in Auth settings only if your use case truly needs it

Code Examples

Refresh before making authed requests javascript 
const { data: { session }, error } = await supabase.auth.refreshSession()
if (error?.code === 'token_expired') {
  // refresh token itself is gone - force re-login
  await supabase.auth.signOut()
}

A failed refresh with token_expired usually means the refresh token was also revoked; re-authenticate the user.

Framework-Specific Fixes

supabase-js

Attach the auth state listener so expired sessions trigger a refresh or re-login automatically.

supabase.auth.onAuthStateChange((event) => {
  if (event === 'TOKEN_REFRESHED') {
    console.log('session refreshed')
  }
  if (event === 'SIGNED_OUT') {
    redirectToLogin()
  }
})

You Might Also Like

refresh_token_not_found Refresh Token Not Found Session containing the refresh token not found. PGRST301 Invalid or Undecodable JWT Provided JWT couldn't be decoded or it is invalid. invalid_credentials Invalid Credentials Login credentials or grant type not recognized.

Frequently Asked Questions

Why am I seeing Supabase error token_expired?

Most often this happens when access token older than the default 1-hour TTL, or when client clock skew beyond the allowed leeway.

How do I fix Supabase error token_expired?

Refresh the session with supabase.auth.refreshSession() before authed calls.

Which frameworks have documented fixes for error token_expired?

This page documents fixes for: supabase-js.

Official Sources

This page is based on the official Supabase documentation linked below and adds practical troubleshooting guidance on top.