diff --git a/auth/flags.go b/auth/flags.go
index 61d83ba8d..6bf67ba36 100644
--- a/auth/flags.go
+++ b/auth/flags.go
@@ -8,6 +8,7 @@ import (
 type (
 	configuration struct {
 		jwtSecret string
+		jwtExpiry int64
 	}
 )
 
@@ -24,4 +25,5 @@ func (c configuration) validate() error {
 // Flags should be called from main to register flags
 func Flags() {
 	flag.StringVar(&config.jwtSecret, "auth-jwt-secret", "", "JWT Secret")
+	flag.Int64Var(&config.jwtExpiry, "auth-jwt-expiry", 3600, "JWT Expiration in minutes")
 }
diff --git a/auth/jwt.go b/auth/jwt.go
index 700d69099..6b634adb1 100644
--- a/auth/jwt.go
+++ b/auth/jwt.go
@@ -5,6 +5,7 @@ import (
 	"github.com/titpetric/factory/resputil"
 	"net/http"
 	"strconv"
+	"time"
 )
 
 type jwt struct {
@@ -28,7 +29,11 @@ func (t *jwt) Verifier() func(http.Handler) http.Handler {
 
 func (t *jwt) Encode(identity Identifiable) string {
 	// @todo Set expiry
-	_, jwt, _ := t.tokenAuth.Encode(jwtauth.Claims{}.Set("sub", strconv.FormatUint(identity.GetID(), 10)))
+	claims := jwtauth.Claims{}
+	claims.Set("sub", strconv.FormatUint(identity.GetID(), 10))
+	claims.SetExpiryIn(time.Duration(config.jwtExpiry) * time.Minute)
+
+	_, jwt, _ := t.tokenAuth.Encode(claims)
 	return jwt
 }