---
title: "Configuring Token Expiry Notifications"
slug: "configuring-token-expiry-notifications"
updated: 2026-11-10T08:01:24Z
published: 2026-11-10T08:01:24Z
canonical: "knowledge.catonetworks.com/configuring-token-expiry-notifications"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.catonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Token Expiry Notifications

This article explains how to configure authentication token expiry notifications for Windows, macOS, and iOS Clients. Notifications give users time to re-authenticate before their access changes.

## Understanding Token Expiry Notifications

Configure notifications for your account in **Access > Client Access > End-User Notifications > Client Operation Notifications**. **About to expire** controls the pre-expiry warning, and **Expired** controls the expired-token prompt. You can enable either, both, or neither.

The pre-expiry warning is sent once at the configured lead time, from 1 to 720 minutes before token expiry. The default is 60 minutes. A final reminder is sent five minutes before expiry. The warning time applies to the account and does not change token validity.

While the Cato authentication token is valid, the user has a **High** confidence level. When it expires, the user is disconnected or moves to a **Low** confidence level, according to the Client Connectivity Policy. Re-authentication restores the **High** confidence level. For more information, see [Configuring the Client Connectivity Policy](/v1/docs/configuring-the-client-connectivity-policy).

> [!TIP]
> **Best Practice:** For Always-On users, allow secured Internet access at a **Low** confidence level to keep Internet traffic protected after token expiry. For more information, see [Remote Internet Security with One-Time Authentication](/v1/docs/remote-internet-security-with-one-time-authentication).

## Configuring Notifications

You need permission to configure Client Access settings. Configure notifications on **Client Access**; the grouped **End-User Notifications** page provides read-only enable states and previews.

**To define when users are prompted to re-authenticate:**

1. From the navigation menu, click **Access > User Authentication**.
2. Open the **Additional Settings** tab
3. In **Re-authentication prompt**, enable **Before token expires: Notify User** and enter the warning time in minutes, from 1 to 720. The default is 60 minutes.
4. Save your changes.