JWT Tokens Never Expire? The Key Box Code

2026-10-30

Saturday, 11:40. You're standing in the hallway of a rented flat by the sea. The host is handing over the keys, cheerful, in a hurry.

"The key box by the door," she says. "Code is 4-4-4-4. It's been that since we opened. Never changed it. Why would we?"

She laughs and leaves. You laugh too.

Then you stand there with a suitcase in one hand and a small cold feeling in your stomach. It has nothing to do with the flat.

It's about the API you shipped in March.

The sentence you'd been avoiding

Let's call you Ines. You're a freelance backend developer, and this is supposed to be your week off. The sea is right there, grey and glittering.

But the host's sentence keeps replaying. Never changed it. Why would we?

Because somewhere in your codebase there's a login route. It hands out a token. You remember typing the settings, a little proud of how smoothly it worked. You also remember not setting any expiry on it. At the time it felt like one less thing to break.

So every token you've ever issued is still good. The one from the first test login. The one on a laptop a former client's intern may have returned or may not have. The one that sat in a screenshot in a chat thread, now buried but not gone.

Nobody has complained. Nothing has happened. That's exactly what makes it hard to think about.

The question you can't ask out loud

You unpack. You make tea in a kitchen with someone else's mugs. You open your laptop "just to check one thing."

You search the question the way people do when they're embarrassed: JWT tokens never expire, is that a security problem?

The answers are a blur of opinions. Some are calm, some are alarmed, and some are written for people with a whole security team. You close the tab feeling less sure than before.

What you really want isn't a lecture. You want someone to say: here's what this means, here's what it doesn't, and here's whether you can still have your holiday.

So here is the plain version, without the alarm. A token with no end date works like that key box code. It's fine on the day you set it up. The trouble is that the world around it keeps moving. People leave. Devices get lost. Old copies float around in places you've forgotten. A door that never changes its code stays open to everyone who ever knew it, for as long as the building stands.

That's why people generally treat a token that lives forever as something worth a second look. It isn't a catastrophe by itself. It's a question you'd rather answer on a calm Tuesday than during an awkward call.

And it's rarely the only question. Where do the tokens live? What happens when someone logs out? Who can end a session? These are connected, and that's what makes the whole thing feel like a fog rather than a task.

The cost nobody sees

The worry has a price, and you're paying it right now.

It's the walk along the front, where you're half there and half in your repository. It's the dinner where you nod at a story and don't hear the ending. It's the quiet thought on Sunday night: If a client asks me about this, what do I say?

There's also the professional version of it. You'd like to be the developer who says "yes, we've looked at that" without a pause. Instead you're the one who knows there's a gap and hopes nobody asks first.

That feeling of not being quite a real, careful professional is common among people who build alone. It has nothing to do with talent. You don't have a second pair of eyes, a review board, or someone whose job is to say "did you check this?"

The turning point on the balcony

On Sunday morning you sit on the little balcony with coffee, and the thought changes shape.

You don't need to become a security expert by Monday. You need a way of looking at the whole API once, in order, so that "never expires" is one line on a list rather than a lump in your chest. Something that says: this one matters, this one is fine, this one you note down and fix next week.

A list doesn't make the problem disappear. It makes it a size you can see. And what you can see, you can schedule.

You email the host a thank-you and, because you can't help it, a kind note about the key box. She replies with a smiley and, you suspect, will not change the code. That's fine. It's her door, not yours.

Yours, you can do something about.

The Monday after

Picture the following Monday. Same desk, same window, a different kind of quiet.

You open the project with a short, ordered list beside it. Token lifetime is one line. You read it, decide, change what you need to, and tick it off. Then you move on to the next line instead of the next worry.

The call at eleven is with a client who has just forwarded a security questionnaire. You read it without your shoulders rising. Half the questions are ones you've already answered, in writing, in your own words.

When the client asks, "So, how are sessions handled?", you don't stall. You tell them what you do and why. They write it down. The call ends five minutes early.

You make a sandwich. You close the laptop at six.

The flat by the sea is a fond memory now, and so is the key box.

If you recognised yourself

If you've been carrying a small doubt about your own API, you don't have to carry it into every free hour.

The Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item review kit for Node/Express and Python. It comes as a PDF with an XLSX tracker, curl tests, an auth-route scanner script, and a client report template. It's built to help you look at your API in order and show what you checked. It supports your own review; it doesn't replace a professional security audit.

It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

See the REST API Security Checklist Kit

An illustrative story, written with AI assistance.