When logging into APIML with an expired apiml token it throws a 400 to the user
Open
@balhar-jakub is already working on this.
Since May 13, 2026.
bug
clarification
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
Describe the bug
Log into APIML and go home over the weekend - the apiml token expires !
Come back in on Monday and can log into the gateway and get a 400
Looking at the Zowe logs it is because the apimlAuthenticationToken JWT has expired
2026-05-11 09:18:54.723 <ZWEAGW1:reactor-http-nio-3:33557110> [35mZWESVUSR[0;39m [36mDEBUG[0;39m ((o.z.a.g.l.DeterministicLoadBalancer)) Exception when trying to parse the JWT token eyJ0eXAiOiJKV1QC.......8mugPBQh2t93LKpwFM: JWT Token is expired
I can log into a private browser and/or delete the apimlAuthenticationToken
Expected behavior
I'd like the APIML to detect the expired token and delete the cookie data and allow me to log back in again
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.