fix(backend): return IdPOAuthAccessToken JWT timestamps in milliseconds by jacekradko · Pull Request #8771 · clerk/javascript

jacekradko · 2026-06-07T23:59:17Z

IdPOAuthAccessToken.fromJwtPayload set expiration, createdAt, and updatedAt from the JWT's raw second-based exp/iat, but M2MToken and the API response expose those fields in milliseconds. So the same OAuth token's timestamps came out 1000x off depending on whether you verified it as a JWT or fetched it from the API, and token.expiration < Date.now() was always true.

The fix is the * 1000 conversion that was already being done everywhere else:

payload.exp*1000// was: payload.exp

Token validity itself was never affected since the expired boolean already used * 1000, only the exposed timestamps were wrong. The OAuth-JWT verify test didn't assert these fields, which is why it slipped through, so I added that coverage.

Summary by CodeRabbit

Bug Fixes
- OAuth access token verification now returns timestamp fields (expiration, createdAt, updatedAt) in milliseconds instead of seconds, ensuring consistency with other token types and API responses.

changeset-bot · 2026-06-07T23:59:21Z

🦋 Changeset detected

Latest commit: ec97370

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-06-07T23:59:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jun 7, 2026 11:59pm

coderabbitai · 2026-06-07T23:59:35Z

📝 Walkthrough

Walkthrough

This PR fixes timestamp field values in IdPOAuthAccessToken when verifying OAuth access tokens as JWTs. The expiration, createdAt, and updatedAt fields are now populated in milliseconds by converting JWT exp/iat claim values (which are in seconds) via multiplication by 1000, aligning with M2MToken behavior and API responses.

Changes

OAuth Token Millisecond Timestamps

Layer / File(s)	Summary
Millisecond timestamp conversion in OAuth token factory `packages/backend/src/api/resources/IdPOAuthAccessToken.ts`	`IdPOAuthAccessToken.fromJwtPayload` multiplies JWT `exp` and `iat` claim values by 1000 when setting `expiration`, `createdAt`, and `updatedAt`.
Test assertions and release documentation `packages/backend/src/tokens/__tests__/verify.test.ts`, `.changeset/idp-oauth-token-ms-timestamps.md`	OAuth JWT verification test assertions verify millisecond timestamps, and a patch changeset documents the timestamp field consistency fix.

🎯 2 (Simple) | ⏱️ ~8 minutes

A rabbit hops through timestamps with glee,
Seconds now dance to millisecond decree,
OAuth tokens sing in sync, unified time,
API and backend aligned in their rhyme. 🐰⏰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and concisely describes the main fix: converting IdPOAuthAccessToken JWT timestamps from seconds to milliseconds, which is the core purpose of this changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-06-08T00:01:53Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8771

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8771

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8771

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8771

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8771

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8771

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8771

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8771

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8771

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8771

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8771

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8771

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8771

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8771

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8771

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8771

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8771

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8771

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8771

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8771

commit: ec97370

github-actions · 2026-06-08T00:02:46Z

API Changes Report

Generated by Break Check on 2026-06-08T00:02:43.956Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

Note
Break Check could not snapshot 3 subpaths; the diff below excludes them.
@clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
@clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
@clerk/testing ./cypress: Symbol not found for identifier: Cypress

@clerk/shared

Current version: 4.15.0
Recommended bump: MINOR → 4.16.0

Subpath `./apiUrlFromPublishableKey`

🟡 Non-breaking Changes (1)

Modified: `apiUrlFromPublishableKey`

- apiUrlFromPublishableKey: (publishableKey: string) => "https://api.clerk.com" | "https://api.lclclerk.com" | "https://api.clerkstage.dev"+ apiUrlFromPublishableKey: (publishableKey: string) => "https://api.lclclerk.com" | "https://api.clerkstage.dev" | "https://api.clerk.com"

Static analyzer: Breaking change in function apiUrlFromPublishableKey: Return type changed: "https://api.clerk.com"|"https://api.lclclerk.com"|"https://api.clerkstage.dev" → "https://api.lclclerk.com"|"https://api.clerkstage.dev"|"https://api.clerk.com"

🤖 AI review (reclassified as non-breaking) (98%): The return type is a union of the exact same three string literals; only the order of union members changed, which is structurally identical in TypeScript — no well-typed consumer code is affected.

Report generated by Break Check

_{Last ran on ec97370. Pushes that change no tracked declarations (no API surface change vs. base) are skipped and don't update this comment.}

wobsoriano

thanks for catching!

fix(backend): return IdPOAuthAccessToken JWT timestamps in milliseconds
ec97370

github-actionsBot added the backend label Jun 7, 2026

vercelBotdeployed to Preview June 7, 2026 23:59 View deployment

wobsoriano approved these changes Jun 9, 2026
View reviewed changes

jacekradko merged commit 48b187d into mainJun 9, 2026
50 checks passed

jacekradko deleted the jacek/fix-idp-oauth-token-timestamps branch June 9, 2026 14:31

clerk-cookie mentioned this pull request Jun 9, 2026
ci(repo): Version packages #8735
Merged

This was referenced Jun 9, 2026
fix(shared): pin apiUrlFromPublishableKey return type for deterministic declaration emit #8783
Merged
Differ reports reorder-only union changes as breaking (phantom Return type changed) clerk/break-check#85
Closed

Navigation Menu

Uh oh!

fix(backend): return IdPOAuthAccessToken JWT timestamps in milliseconds - #8771

fix(backend): return IdPOAuthAccessToken JWT timestamps in milliseconds#8771
jacekradko merged 1 commit into
mainfrom
jacek/fix-idp-oauth-token-timestamps

jacekradko commented Jun 7, 2026•
edited
Loading

Uh oh!

changeset-botBot commented Jun 7, 2026

Uh oh!

vercelBot commented Jun 7, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Jun 7, 2026•
edited
Loading

Walkthrough

Changes

Uh oh!

pkg-pr-newBot commented Jun 8, 2026

Uh oh!

github-actionsBot commented Jun 8, 2026

Uh oh!

wobsoriano left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jacekradko commented Jun 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

changeset-botBot commented Jun 7, 2026

🦋 Changeset detected

Uh oh!

vercelBot commented Jun 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitaiBot commented Jun 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

pkg-pr-newBot commented Jun 8, 2026

Uh oh!

github-actionsBot commented Jun 8, 2026

API Changes Report

Summary

@clerk/shared

Subpath ./apiUrlFromPublishableKey

🟡 Non-breaking Changes (1)

Modified: apiUrlFromPublishableKey

Uh oh!

wobsoriano left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jacekradko commented Jun 7, 2026•
edited
Loading

vercelBot commented Jun 7, 2026•
edited
Loading

coderabbitaiBot commented Jun 7, 2026•
edited
Loading

Subpath `./apiUrlFromPublishableKey`

Modified: `apiUrlFromPublishableKey`