JWT Clock Skew

Clock skew is the time difference between the issuing authentication server and verifying API servers. JWT libraries often allow a small leeway when checking exp and nbf so minor NTP drift does not reject otherwise valid tokens during normal operations. Typical leeway is tens of seconds, not many minutes. Excessive leeway weakens expiry guarantees and widens replay windows for stolen tokens. Prefer synchronized clocks via NTP or chrony and keep leeway minimal and consistent. When debugging invalid token errors, compare iat and exp timestamps to verifier UTC time before changing secrets or algorithms. Document leeway settings across services so microservices behave consistently under the same policy.