# Ensure JWT expiry is set to a reasonable, non-excessive duration

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103907396655-ensure-jwt-expiry-is-set-to-a-reasonable-non-excessive-duration
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the access token (JWT) expiry time is set to a reasonable value, such as the default of 3600 seconds (1 hour) or shorter. Values longer than one hour should be avoided, and values below five minutes are also not recommended because they cause frequent token refreshes.

**Rationale**

An access token remains valid until it expires, even if the user signs out or their account is changed. The longer the expiry time, the longer a stolen token can be used by an attacker. Keeping the expiry at one hour or less limits this window, while the refresh token mechanism keeps legitimate users signed in.

**Impact**

-   Limits how long a stolen access token can be used
    
-   Changes to user access take effect sooner
    
-   Very short values increase load on the Auth server
    

**Default Value**

By default, access tokens expire after 3600 seconds (1 hour).

**Pre-Requisites**

-   Project Owner or Admin role
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select JWT Keys.
    
4.  Check the Access token expiry time (shown on the Legacy JWT Secret tab in some projects).
    
5.  If it is longer than 3600 seconds without a documented reason, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select JWT Keys.
    
4.  Set Access token expiry time to 3600 seconds or less.
    
5.  Select Save.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select JWT Keys.
    
4.  Set Access token expiry time back to its previous value.
    
5.  Select Save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/sessions](https://supabase.com/docs/guides/auth/sessions)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.