Direct answer

The token exp timestamp is earlier than the verifier's current time. Decode the claim, confirm seconds versus milliseconds, and obtain a new token through the intended flow.

Where this error appears

JWT authentication

Root cause

The token may genuinely be expired, generated with milliseconds instead of seconds, checked on a host with incorrect time, or reused after a session was revoked.

Minimal reproduction

{"exp": 1700000000}

Corrected example

Issue a new short-lived access token through the trusted refresh or login flow. Do not edit the payload; that invalidates the signature.

Verify the fix

Decode exp as Unix seconds, compare it with trusted server UTC, then verify the signature and claims.

Things to check

  • Decoding is not signature verification.
  • Keep clock-skew allowances small and explicit.

Authoritative reference

Confirm version-specific behavior in RFC 7519。