SigNoz/signoz · error · errors SigNozError

ErrCodeTokenExpired

ErrCodeTokenExpired

Error message

token has not been used for too long

What it means

Returned by Token.IsExpired when LastObservedAt is older than the idle duration, i.e. the token hasn't been used recently. This implements idle expiry for API/refresh tokens.

Source

Thrown at pkg/types/authtypes/token.go:141

func (typ *Token) IsValid(rotationInterval time.Duration, idleDuration time.Duration, maxDuration time.Duration) error {
	// Check for expiration
	if err := typ.IsExpired(idleDuration, maxDuration); err != nil {
		return err
	}

	// Check for rotation
	if err := typ.IsRotationRequired(rotationInterval); err != nil {
		return err
	}

	return nil
}

func (typ *Token) IsExpired(idleDuration time.Duration, maxDuration time.Duration) error {
	// If now - last_seen_at > idle_duration, the token will be considered as expired.
	if !typ.LastObservedAt.IsZero() && typ.LastObservedAt.Before(time.Now().Add(-idleDuration)) {
		return errors.New(errors.TypeUnauthenticated, ErrCodeTokenExpired, "token has not been used for too long")
	}

	// If now - created_at > max_duration, the token will be considered as expired.
	if typ.CreatedAt.Before(time.Now().Add(-maxDuration)) {
		return errors.New(errors.TypeUnauthenticated, ErrCodeTokenExpired, "token was created a long time ago")
	}

	return nil
}

func (typ *Token) IsRotationRequired(rotationInterval time.Duration) error {
	if !typ.RotatedAt.IsZero() && typ.RotatedAt.Before(time.Now().Add(-rotationInterval)) {
		return errors.New(errors.TypeUnauthenticated, ErrCodeTokenRotationRequired, "token needs to be rotated")
	}

	if typ.RotatedAt.IsZero() && typ.CreatedAt.Before(time.Now().Add(-rotationInterval)) {
		return errors.New(errors.TypeUnauthenticated, ErrCodeTokenRotationRequired, "token needs to be rotated")
	}

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Generate a new token by authenticating again
2. Use the token at least once per idle window to keep it alive
3. Ask the admin to configure a larger idleDuration if long-lived unattended tokens are intended

if !tok.LastObservedAt.IsZero() && time.Since(tok.LastObservedAt) > idleDuration { /* re-authenticate */ }

if err := tok.IsExpired(idle, max); err != nil {
    if strings.Contains(err.Error(), "not been used") { /* idle expiry: re-login */ }
}

When it happens

Trigger: Calling IsValid or Rotate on a token whose lastObservedAt is before now minus idleDuration (e.g. unused for 30 days).

Common situations: Scripts/agents left unused over holidays, stale PATs, or environments where the token was never exercised after creation.

Related errors

• CodeInvalidInput
• ErrCodeTokenRotationRequired
• CodeUnauthenticated
• ErrCodeTokenOlderLastObservedAt
• ErrCodeResetPasswordTokenExpired

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/9baa33cdab0a1ddd. Report an issue: GitHub.