# JWT Without Expiration

> Detects JWTs issued without expiration claims, creating tokens that remain valid indefinitely.

- Skill: `zakirkun/jwt-without-expiration` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/jwt-without-expiration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/jwt-without-expiration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/jwt-without-expiration

---


# JWT Without Expiration

## Overview
JWTs without expiration (`exp` claim) or with very long expiration never become invalid unless the secret is rotated. This means:
- Stolen tokens remain valid forever
- Deprovisioned users can still authenticate
- No way to force re-authentication without key rotation

## Remediation
- Set short-lived access tokens: 15 minutes to 1 hour
- Use refresh tokens with longer validity for user experience
- Implement token revocation list for immediate invalidation