# Okta Python SDK - client\_assertion expiration woes

**URL:** <https://devforum.okta.com/t/okta-python-sdk-client-assertion-expiration-woes/13348>\
**Category:** Questions\
**Created:** [March 15, 2021, 4:20pm UTC](https://devforum.okta.com/t/okta-python-sdk-client-assertion-expiration-woes/13348 "2021-03-15T16:20:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kittiah](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/kittiah/32/2726_2.png) [@Kittiah](https://devforum.okta.com/u/Kittiah)\
**Post date:** [March 15, 2021, 4:20pm UTC](https://devforum.okta.com/t/okta-python-sdk-client-assertion-expiration-woes/13348/1 "2021-03-15T16:20:23Z")

</div>

Using the official Okta Python SDK to do some automation work with a key-pair authenticated OAuth Service client, and today I started getting ‘invalid\_client - The client\_assertion token has an expiration too far into the future’ errors when submitting requests to the API.

Investigating, I found the exp value in the generated client\_assertion JWT was only +1 second too far beyond the 1 hour validity window that the Auth Server seems to demand. This development is being done on an enterprise workstation with the time set centrally for the domain, so adjusting the local time isn’t an option.

I’ve been able to bodge this by editing the SDK files and just deducting 60 seconds from the epoch time being used when generating the exp value for the client\_assertion JWTs, but I was wondering if there was a better way of handling this? Is there some clock skew functionality for the Org Auth Server that I can configure somehow? Am I missing some client config in the SDK that would allow me to manage this? Any advice appreciated.

---

<div class="post-metadata">

**Author:** ![erin.p](https://avatars.discourse-cdn.com/v4/letter/e/e480ec/32.png) [@erin.p](https://devforum.okta.com/u/erin.p)\
**Post date:** [March 15, 2021, 6:48pm UTC](https://devforum.okta.com/t/okta-python-sdk-client-assertion-expiration-woes/13348/2 "2021-03-15T18:48:14Z")

</div>

[This article](https://support.okta.com/help/s/article/What-is-the-lifetime-of-the-JWT-tokens?language=en_US) explains token lifetime rules and how to adjust the token lifetime when using a custom authorization server

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 26, 2024, 12:34am UTC](https://devforum.okta.com/t/okta-python-sdk-client-assertion-expiration-woes/13348/3 "2024-01-26T00:34:50Z")

</div>

Closed on January 26, 2024, 12:34am UTC