diff --git a/royalnet/backpack/tables/tokens.py b/royalnet/backpack/tables/tokens.py
index f9e80cd8..eaa58a2b 100644
--- a/royalnet/backpack/tables/tokens.py
+++ b/royalnet/backpack/tables/tokens.py
@@ -51,5 +51,5 @@ class Token:
         }
 
     @classmethod
-    async def authenticate(cls, alchemy, session, token: str) -> "Token":
+    async def find(cls, alchemy, session, token: str) -> "Token":
         return await ru.asyncify(session.query(alchemy.get(cls)).filter_by(token=token).one_or_none)
diff --git a/royalnet/constellation/api/apidata.py b/royalnet/constellation/api/apidata.py
index a8915c50..0a6bf724 100644
--- a/royalnet/constellation/api/apidata.py
+++ b/royalnet/constellation/api/apidata.py
@@ -18,9 +18,11 @@ class ApiData(dict):
         raise MissingParameterError(f"Missing '{key}'")
 
     async def token(self) -> Token:
-        token = await Token.authenticate(self.star.alchemy, self.session, self["token"])
+        token = await Token.find(self.star.alchemy, self.session, self["token"])
         if token is None:
             raise ForbiddenError("'token' is invalid")
+        if token.expired:
+            raise ForbiddenError("Login token has expired")
         return token
 
     async def user(self) -> User: