How to change auth's jwt expiration time?

[LCHONE]

The doc says "Most applications should use the default expiration time of 1 hour. This can be customized in your project's Auth settings in the Advanced Settings section.". But I can't find options in auth setting's advanced section where only has two settings-"Request Duration" and "Auth Database Connections".

[joshholmes22]

I can see it in Settings -> Project Settings -> JWT Keys

That has an Access token expiry time that I think you're looking for

https://supabase.com/dashboard/project/PROJECTID/settings/jwt

[dacameron-proactive]

Looking for this in Aug 2026, and the setting ain't there.

[GaryAustin1]

It is now here: https://supabase.com/dashboard/project/_/auth/sessions

[dacameron-proactive]

Yeah.... ish. I presume yer talking about "Inactivity timeout". Talking to Supabase's AI about it (and, yes, that can be hit and miss), that's the timeout after which and expired JWT's session will be booted. The issue is the expiry on the JWT can't be controlled any more, and it thought it was 1hr. So like... 1hr for the JWT to age-out, then 5min for SB to go "oh sh!t, yeah, you can't come in"

I dunno if this is all true, but what I do know that setting "Inactivity timeout" to be 0.1 (six min) does NOT mean that front end users lose their auth after 6min.

I want inactive client users to be de-authed after 15min, and the best SB's AI could come up with (corroborated by Gemini), is "roll yer own".

PS: who measures session inactivity hours in hours (even it values to 1 decimal places are accepted)?!?!

Thanks for the reply, btw!

[GaryAustin1]

No. I'm talking about access token setting.

This is how long a JWT is good for until it has to be refreshed. If set to 5 minutes then a request to the server will be made before that to make sure the JWT can still be refreshed. If not after 5minutes the JWT is no longer good. Default is 1 hour.

[dacameron-proactive]

OK cool! I shall have a look! Thanks for the help @ quick turn-around