Clerk session tokens are short-lived JWTs of about one minute that the client refreshes silently

The lifetime is deliberately short so that revoking a session takes effect quickly without a database lookup on every request. The frontend SDK refreshes in the background, which is why the pattern is invisible until you step outside it.

The consequences are concrete. Never cache a session token, never hand one to a background job that runs later, and never persist one anywhere. Server-side verification uses the instance JWKS and should allow a small clock tolerance rather than assuming the clocks match. When you need a token with a longer lifetime or custom claims for a third-party service, use a JWT template, which mints a separate token whose lifetime and claims you control, rather than stretching the session token.