How do I fix "JWT expired / Auth session missing"?

Use your auth library's session helpers instead of storing tokens yourself. With Supabase and Next.js, use the SSR package's middleware so sessions refresh on each request. Treat an expired token as 'refresh and retry', not as signed out.

JWT expired / Auth session missing

Supabase
Any token-based auth

What it means

Sign-in tokens are short-lived on purpose, often one hour. When the app does not refresh the token, requests start failing and the user looks logged out.

Why it happens

The app stores the token once and never refreshes it.
The server reads the session without the middleware or helper that refreshes it.
The token is copied into your own storage and goes stale there.

How to fix it

Use your auth library's session helpers instead of storing tokens yourself.
With Supabase and Next.js, use the SSR package's middleware so sessions refresh on each request.
Treat an expired token as 'refresh and retry', not as signed out.

Let your AI find the cause

Paste this into Claude Code, Cursor, Lovable or whichever AI built your app. It looks first and changes nothing until you have read the answer.

Users of my app get 'JWT expired' or appear logged out after about an hour. Without changing anything yet, explain how this project stores and refreshes the sign-in session, on the browser and on the server, and where a refresh should happen but does not.