diff --git a/backend/pkg/spot/auth/authorizer.go b/backend/pkg/spot/auth/authorizer.go
index 1cc972add..63067fee9 100644
--- a/backend/pkg/spot/auth/authorizer.go
+++ b/backend/pkg/spot/auth/authorizer.go
@@ -9,5 +9,5 @@ func (a *authImpl) IsAuthorized(authHeader string, permissions []string, isExten
 	if err != nil {
 		return nil, err
 	}
-	return authUser(a.pgconn, jwtInfo.UserId, jwtInfo.TenantID, int(jwtInfo.ExpiresAt.Unix()))
+	return authUser(a.pgconn, jwtInfo.UserId, jwtInfo.TenantID, int(jwtInfo.IssuedAt.Unix()), isExtension)
 }
diff --git a/backend/pkg/spot/auth/storage.go b/backend/pkg/spot/auth/storage.go
index b0f63e494..0647af1be 100644
--- a/backend/pkg/spot/auth/storage.go
+++ b/backend/pkg/spot/auth/storage.go
@@ -3,21 +3,24 @@ package auth
 import (
 	"fmt"
 	"openreplay/backend/pkg/db/postgres/pool"
+	"strings"
 )
 
-func authUser(conn pool.Pool, userID, tenantID, jwtIAT int) (*User, error) {
+func authUser(conn pool.Pool, userID, tenantID, jwtIAT int, isExtension bool) (*User, error) {
 	sql := `
 		SELECT user_id, name, email, EXTRACT(epoch FROM spot_jwt_iat)::BIGINT AS spot_jwt_iat
 	   	FROM public.users
 	   	WHERE user_id = $1 AND deleted_at IS NULL
 	   	LIMIT 1;`
-
+	if !isExtension {
+		sql = strings.ReplaceAll(sql, "spot_jwt_iat", "jwt_iat")
+	}
 	user := &User{TenantID: 1, AuthMethod: "jwt"}
 	if err := conn.QueryRow(sql, userID).Scan(&user.ID, &user.Name, &user.Email, &user.JwtIat); err != nil {
 		return nil, fmt.Errorf("user not found")
 	}
 	if user.JwtIat == 0 || abs(jwtIAT-user.JwtIat) > 1 {
-		return nil, fmt.Errorf("token expired")
+		return nil, fmt.Errorf("token has been updated")
 	}
 	return user, nil
 }