# Auth0 Bearer Token SID Repeats Across Users

**URL:** <https://community.auth0.com/t/auth0-bearer-token-sid-repeats-across-users/189181>\
**Category:** Get Help\
**Tags:** authentication-sessions, sessions\
**Created:** [July 14, 2025, 8:46pm UTC](https://community.auth0.com/t/auth0-bearer-token-sid-repeats-across-users/189181 "2025-07-14T20:46:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Titorr2001](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/titorr2001/32/75109_2.png) [@Titorr2001](https://community.auth0.com/u/Titorr2001)\
**Post date:** [July 14, 2025, 8:46pm UTC](https://community.auth0.com/t/auth0-bearer-token-sid-repeats-across-users/189181/1 "2025-07-14T20:46:53Z")

</div>

Hi everyone,

I’m encountering an issue with Auth0’s bearer tokens, specifically regarding the `sid` (session ID) claim.

Here’s what happened:

1. I was logged in as **User A** , and their session eventually expired.
2. Afterwards, I logged in as **User B**.
3. I noticed that the **new bearer token for User B contained the same `sid` value** that was previously issued to User A.

Is this expected behavior? Shouldn’t the `sid` be unique per user session?  
Could this be a misconfiguration on my end, or is it potentially a bug within Auth0?

Any insights or experiences with similar behavior would be greatly appreciated. Thanks in advance!

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [July 17, 2025, 10:57am UTC](https://community.auth0.com/t/auth0-bearer-token-sid-repeats-across-users/189181/3 "2025-07-17T10:57:50Z")

</div>

Hi @Titorr2001, and thank you for your question!

This is the expected behavior and not a misconfiguration or a bug.

The `sid` (Session ID) claim in the token does not identify the _user’s_ session, but rather the **browser’s session** with the Auth0 authentication server.

When User B logs in from the same browser, the browser sends the existing session cookie along with the login request. Auth0’s session layer detects this existing session, validates it, and then re-associates it with User B’s new authentication event.

Because the underlying browser session is being reused, the **`sid` remains the same**. However, the most important claim for identifying the user, the **`sub`** (subject) claim, will have correctly changed to reflect User B’s unique ID.

I hope this helps you!

Sincerely,  
Teodor.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 31, 2025, 10:58am UTC](https://community.auth0.com/t/auth0-bearer-token-sid-repeats-across-users/189181/4 "2025-07-31T10:58:16Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.