QuantumNous/new-api · error · Error

Session expired!

Error message

Session expired!

What it means

Thrown by getFreshAuthHeaders when a token refresh was required and the outcome was NOT a transient error — i.e. the refresh was rejected (expired/invalid session, 401) and no unexpired access token remains in the store. 'Session expired!' is the terminal signal that the user must re-authenticate; retrying will not help.

Source

Thrown at web/src/lib/auth-session.ts:419

  const outcome = await refreshAuthentication()
  if (outcome.kind === 'authenticated') {
    return getCommonHeaders()
  }

  const current = useAuthStore.getState().auth
  if (
    current.accessToken &&
    current.accessExpiresAt &&
    current.accessExpiresAt > Math.floor(Date.now() / 1000)
  ) {
    return getCommonHeaders()
  }

  if (outcome.kind === 'transient_error') {
    throw new Error(t('Request failed'), { cause: outcome.error })
  }
  throw new Error(t('Session expired!'))
}

View on GitHub (pinned to e2c7aa7b10)

Solutions

1. Redirect the user to the sign-in page when this error is caught — the session is unrecoverable by design.
2. Verify server session TTL settings versus expected idle time if expiry happens too aggressively.
3. Check that the refresh credential (cookie/header) is actually sent with the refresh request (withCredentials, same-site cookie config).
4. If sessions expire unexpectedly fast, inspect backend logs for the session-revocation reason.

try {
  headers = await getFreshAuthHeaders()
} catch (error) {
  if (/Session expired/i.test(error.message)) {
    // terminal: clear auth store, redirect to /sign-in?redirect=<current route>, no retry
  }
}

When it happens

Trigger: refreshAuthentication() returns an outcome other than 'authenticated'/'transient_error' (session rejected/revoked server-side) while the stored access token is absent or past accessExpiresAt.

Common situations: Server-side session expiry or revocation (logout-all, admin kick, password change); long-lived tab resumed after the refresh token TTL passed; cookie-based refresh credential cleared by browser policy.

Related errors

• Failed to load API keys
• Invalid authentication rotation response
• Authentication rotation has no active session
• Authentication rotation session mismatch
• Request failed

AI-assisted analysis of QuantumNous/new-api@e2c7aa7b10 (2026-08-15). Data as JSON: /api/errors/a78b28479bf3545e. Report an issue: GitHub.