alibaba/nacos · error · AccessException

expired token

Error message

expired token

What it means

After resolving the username, the manager computes the token's expiry from its JWT 'exp' claim; if that time is at or before the current clock it throws AccessException('expired token'). This is the expected, operational auth-expiry path: the token was once valid but its TTL elapsed. The TTL is governed by nacos.plugin.auth.nacos.token.expire.seconds.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/token/impl/CachedJwtTokenManager.java:173

        tokenMap.putIfAbsent(token,
            new TokenEntity(token, username, expiredTime, authentication, user));
    }
    
    @Override
    public NacosUser parseToken(String token) throws AccessException {
        TokenEntity cached = tokenMap.get(token);
        if (cached != null) {
            return cached.getNacosUser();
        }
        Authentication authentication = jwtTokenManager.getAuthentication(token);
        String username = authentication.getName();
        if (username == null || username.isEmpty()) {
            throw new AccessException("invalid token, username is empty");
        }
        long expiredTime =
            TimeUnit.SECONDS.toMillis(jwtTokenManager.getExpiredTimeInSeconds(token));
        if (expiredTime <= System.currentTimeMillis()) {
            throw new AccessException("expired token");
        }
        NacosUser user = jwtTokenManager.parseToken(token);
        tokenMap.putIfAbsent(token,
            new TokenEntity(token, username, expiredTime, authentication, user));
        return user;
    }
    
    public long getTokenTtlInSeconds(String token) throws AccessException {
        TokenEntity cached = tokenMap.get(token);
        if (cached != null) {
            return TimeUnit.MILLISECONDS.toSeconds(
                cached.getExpiredTimeMills() - System.currentTimeMillis());
        }
        return jwtTokenManager.getTokenTtlInSeconds(token);
    }
    
    @Override
    public long getTokenValidityInSeconds() {

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Re-authenticate to obtain a fresh token (the SDK should do this automatically via its token-refresh logic).
2. If caused by clock skew, synchronize node clocks (NTP/chrony) so exp comparisons are consistent.
3. Optionally raise nacos.plugin.auth.nacos.token.expire.seconds if the TTL is too short for your workload.
4. Ensure the SDK's token refresh task is enabled and running.

Example fix

// before: stale token reused
client.setAccessToken(oldToken); // -> expired token

// after: re-login on expiry
try {
    client.doRequest(...);
} catch (AccessException e) {
    if ("expired token".equals(e.getMessage())) {
        client.relogin(); // fetch a fresh token
        client.doRequest(...);
    }
}

// Before relying on a cached token, check its TTL and refresh proactively.
long ttl = tokenManager.getTokenTtlInSeconds(token);
if (ttl <= 0) {
    // expired (or about to) -> re-authenticate
    token = login(username, password);
}

try {
    tokenManager.parseToken(token);
} catch (AccessException e) {
    if ("expired token".equals(e.getMessage())) {
        token = relogin(); // obtain a fresh token, then retry
        tokenManager.parseToken(token);
    } else {
        throw e;
    }
}

When it happens

Trigger: A client reuses an access token past its configured expire-seconds window; the token cache was cleared (e.g. by applyTokenConfig cache-clear) forcing a re-parse that now sees exp in the past; clock skew between the issuing node and the parsing node.

Common situations: Long-running SDK sessions that never re-login; failover to a node whose clock is ahead; admin clearing the token cache mid-session.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• token expired!
• the length of secret key must great than or equal 32 bytes;
• user not found!
• token invalid!
• Nacos auth plugin has not been initialized

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/75389013ca3d2f69. Report an issue: GitHub.