The JSON Web Token (JWT) expires after 60 minutes, even though the Sign On Policy has a Session Lifetime of a different value (for example, 120 minutes).

• OpenID Connect (OIDC)/OAuth
• JSON Web Token (JWT)
• Okta Classic Engine
• Okta Identity Engine (OIE)

The JWT validity/lifetime is independent of the Session Lifetime defined in any of the Okta Sign-On Policies. To change the JWT validity/lifetime, it must be modified in the Authorization Server configuration, which requires the API Access Management feature. Default values for JWT can be found in the Token lifetime article.

To modify the JWT validity/lifetime, the access policy/rule must be modified in the Authorization Server settings. To do this, navigate to the Okta Admin Console > Security > API > Authorization Server > Access Policy > Rule. 

More details on how to modify Access Policies and Rules can be found in Create access policies documentation.