Lovable
auth
JWT Token Expires Silently Causing Unexpected Logout
Users experience sudden logout after being idle or when making requests. API calls start failing with 401 Unauthorized. The JWT token has expired but the app didn't refresh it before it became invalid.
By default, Supabase tokens expire after 1 hour. Without proper refresh token handling, expired tokens cause failures silently rather than triggering re-authentication flow.
Error Messages You Might See
401 Unauthorized
JWT expired
Invalid or expired token
auth/invalid-api-key
Common Causes
- autoRefreshToken not enabled in Supabase client config
- No error handling for expired token (401 response)
- Refresh token also expired or missing
- App doesn't check token expiration before making requests
- Network request fails during token refresh
How to Fix It
Enable automatic token refresh and add auth state listener:
const { data: { session } } = await supabase.auth.getSession();
supabase.auth.onAuthStateChange((event, session) => {
if (event === 'TOKEN_REFRESHED') {
console.log('Token refreshed');
} else if (event === 'SIGNED_OUT') {
// Redirect to login
}
});Real developers can help you.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get Help