It was my fault. Auth0 is returning always expires_in. We just internally stored expires_at.
expires_in
expires_at