Connection token expired

The connection token on the Connect step is single-use and expires after 60 minutes. Sometimes that’s not enough — the plugin took a while to install, or you had to step away mid-setup. Here’s the recovery flow.

How to recognise it

The Connect step shows:

Token timed out. Generate a new one to continue.

In the WordPress plugin you’ll see (if you tried to paste the expired token):

Invalid or expired onboarding token

Both messages map to the same root cause: the token’s 60-minute TTL elapsed before WordPress called our /enroll endpoint with it.

Generate a fresh token

Onboarding wizard → Connect step → Generate new token button. Hubbee creates a new token, the old one is invalidated immediately (no leak risk if you posted the old one somewhere).

If you’re outside the onboarding wizard:

1. Dashboard → Sites → Add Site
2. Same dialog, same “Generate Code” button
3. Paste into WP-Admin → Hubbee → Settings

The new token works for another 60 minutes from generation.

Why is the TTL 60 minutes

Long enough for a clean install + plugin upload + paste, even with a slow upload over hotel wifi. Short enough that a token forgotten in a Slack DM doesn’t sit around forever as a valid connect-anything credential.

The token can be used once. After successful use, even within the 60-minute window, it can never be used again. Two consequences:

• You can paste the token into a single WordPress site, not into multiple
• If you accidentally pasted it into the wrong site, it’s now “spent” — you must generate a fresh one for the intended site

Common scenarios

“I generated the token, downloaded the plugin, and went to lunch.” Lunch took 90 minutes. Token’s gone. Regenerate, install the (already downloaded) plugin, paste the new token. Total recovery time: under 2 minutes.

“My WordPress admin took 30 minutes to load.” Possibly a slow host or a plugin doing heavy work on every admin page load. Token’s still good for another 30 minutes — paste it before the timer runs out. If your WP-Admin is consistently slow, look at debug logs (Yoast Premium and WooCommerce admin extensions are common culprits).

“I pasted the token into the wrong site.” The token is now spent — that wrong site is now connected to Hubbee, the intended site is not. Two options:

1. Keep the unintended site connected (just remove it from the dashboard later)
2. Disconnect the wrong site: Dashboard → Sites → wrong-site → Settings → Disconnect. This frees up your site count quota but the token is still spent. Generate a fresh token for the intended site.

“I keep getting ‘token expired’ immediately after generating.” Server clock drift or browser/Hubbee timestamp mismatch. Hard-refresh the page (Cmd-Shift-R), check your computer’s clock is on actual time, then regenerate. If it persists, sign out and sign back in — that resets all session state.

What if I lost the token email?

Connection tokens are not emailed. They appear only in the dashboard on the Connect step. No reset link, no “send me the token again” — just click Generate new token. The old one (wherever it is) is invalidated the moment you generate a replacement.

Security note

Tokens are stored hashed in our database — even our support team cannot read your original token value. If you ever needed to give the token to support to investigate, you’d have to send it to us directly (we’d never ask, and would discard immediately after diagnosis).

The 60-minute TTL plus single-use enforcement means a leaked token has at most one hour and one use of risk. The downside is the small recovery friction this article describes.