I'm seeing

TryRefreshTokenError: Signature has expired

being raised from the backend sometimes and I'm wondering what I should do about it?

hey @.atambo

This is the stack trace:

File 
"/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/framework/fastapi/__init__.py", line 42, in func
    session = await recipe.verify_session(
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/recipe.py", line 358, in verify_session
    return await self.api_implementation.verify_session(
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/api/implementation.py", line 90, in verify_session
    return await get_session_from_request(
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/session_request_functions.py", line 172, in get_session_from_request
    session = await recipe_interface_impl.get_session(
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/recipe_implementation.py", line 219, in get_session
    response = await session_functions.get_session(
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/session_functions.py", line 185, in get_session
    raise e
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/session_functions.py", line 153, in get_session
    access_token_info = get_info_from_access_token(
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/access_token.py", line 129, in get_info_from_access_token
    raise_try_refresh_token_exception(e)
  File "/opt/conda/envs/szl/lib/python3.10/site-packages/supertokens_python/recipe/session/exceptions.py", line 32, in raise_try_refresh_token_exception
    raise TryRefreshTokenError(ex) from None
supertokens_python.recipe.session.exceptions.TryRefreshTokenError: Signature has expired

Yes. That should happen on its own unless there is a config issue. Are you using axios on the frontend? If yes, have you added our axios interceptors? Also, can I see the request and response headers of any API call that is protected by session verification on the backend?

I’m using fetch on the react native side of things and things do generally work. Unfortunately it seems to happen very infrequently and we do not log our HTTP headers so I don’t really know how the mobile app is behaving when this happens.

Fetch should work fine as well. So you could try this: - In the dev env, set the access token lifetime to something like 1 min in the core config. Restart the core and the python backend layer. - Login and create a new session. Make an API call from your mobile app that is protected by session verification. - Wait for 1 min (so the access token expires). - Make the same API call from your mobile app and this time, the backend should fail with a 401, and the frontend should auto refresh the session, and then call the API once again which should succeed. From the backend point of view, you will see: API call (401) -> Session refresh call (200) -> API call (200). If the above is happening, then you can ignore the

TryRefreshTokenError: Signature has expired

for now. But, just to be sure, maybe setup your backend so that the next time this type of error is logged out, you can check in your logs that the refresh API was called immediately after (which it should be).