How to fix "jwt expired" and "token is not yet valid" errors

How this is calculated

Start by pasting the failing token into the JWT Decoder and reading the Time claims card. If exp is in the past by hours or days, the client is reusing an old token, so look at your refresh logic and at caches that keep a token after it expires. If exp is only a little in the past, or nbf is a little in the future, the issuer's clock and the verifier's clock disagree. Containers and virtual machines drift when time sync isn't running, and a gap of a few minutes is enough to break short tokens. Fix the clocks with NTP, then add a small leeway in the verifier: clockTolerance in jsonwebtoken and jose, leeway in PyJWT, clockSkewSeconds in jjwt. ASP.NET's ClockSkew already defaults to 5 minutes, which hides drift but also means tokens live that long past exp. If exp shows a date far in the future, it was written in milliseconds, and the issuer needs a fix. If the decoder shows a time claim as a string, the issuer is writing quotes around the number. The last cause is a token lifetime that's simply too short for the request path, like a 1 minute token passed through a slow queue. Use the Time settings to try a leeway and see which setting makes the token pass.

Verdict

Keep leeway small, around 30 seconds to 2 minutes, and fix the clocks rather than raising it to hide the problem. Never extend a token by editing its exp, since that breaks the signature. Ask the issuer for a new token, or use a refresh token to get one.