diff --git a/cmd/cryptool/shell/fernet.go b/cmd/cryptool/shell/fernet.go
index 972f4c7cd1..6ebd0b99fd 100644
--- a/cmd/cryptool/shell/fernet.go
+++ b/cmd/cryptool/shell/fernet.go
@@ -16,7 +16,6 @@ package shell
 
 import (
 	"fmt"
-	"time"
 
 	"yunion.io/x/pkg/util/timeutils"
 
@@ -110,7 +109,7 @@ func init() {
 		}
 		fmt.Println("primary key hash:", fm.PrimaryKeyHash())
 
-		ret := fm.Decrypt([]byte(args.MSG), time.Hour*-1)
+		ret := fm.Decrypt([]byte(args.MSG))
 		if len(ret) == 0 {
 			return fmt.Errorf("invalid message")
 		}
diff --git a/pkg/keystone/models/credentials.go b/pkg/keystone/models/credentials.go
index 205b3dc272..75bf552880 100644
--- a/pkg/keystone/models/credentials.go
+++ b/pkg/keystone/models/credentials.go
@@ -18,7 +18,6 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
-	"time"
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/pkg/errors"
@@ -214,7 +213,7 @@ func credentialExtra(cred *SCredential, out api.CredentialDetails) api.Credentia
 }
 
 func (self *SCredential) getBlob() []byte {
-	return keys.CredentialKeyManager.Decrypt([]byte(self.EncryptedBlob), time.Duration(-1))
+	return keys.CredentialKeyManager.Decrypt([]byte(self.EncryptedBlob))
 }
 
 func (self *SCredential) GetAccessKeySecret() (*api.SAccessKeySecretBlob, error) {
diff --git a/pkg/keystone/tokens/token.go b/pkg/keystone/tokens/token.go
index b9f5e4e038..cf02e18fec 100644
--- a/pkg/keystone/tokens/token.go
+++ b/pkg/keystone/tokens/token.go
@@ -42,7 +42,7 @@ func GetDefaultToken() (string, error) {
 			UserId:    simpleToken.GetUserId(),
 			Method:    api.AUTH_METHOD_TOKEN,
 			ProjectId: simpleToken.GetProjectId(),
-			ExpiresAt: now.Add(24 * time.Hour),
+			ExpiresAt: now.Add(time.Duration(options.Options.TokenExpirationSeconds) * time.Second),
 			AuditIds:  []string{utils.GenRequestId(16)},
 		}
 	}
@@ -160,7 +160,7 @@ func (t *SAuthToken) Encode() ([]byte, error) {
 }
 
 func (t *SAuthToken) ParseFernetToken(tokenStr string) error {
-	tk := keys.TokenKeysManager.Decrypt([]byte(tokenStr), time.Duration(options.Options.TokenExpirationSeconds)*time.Second)
+	tk := keys.TokenKeysManager.Decrypt([]byte(tokenStr)) // , time.Duration(options.Options.TokenExpirationSeconds)*time.Second)
 	if tk == nil {
 		return ErrExpiredToken
 	}
@@ -168,6 +168,9 @@ func (t *SAuthToken) ParseFernetToken(tokenStr string) error {
 	if err != nil {
 		return errors.Wrap(err, "decode error")
 	}
+	if t.ExpiresAt.Before(time.Now()) {
+		return ErrExpiredToken
+	}
 	return nil
 }
 
diff --git a/pkg/keystone/tokens/token_test.go b/pkg/keystone/tokens/token_test.go
index 636dabdd7d..410594ca9a 100644
--- a/pkg/keystone/tokens/token_test.go
+++ b/pkg/keystone/tokens/token_test.go
@@ -54,7 +54,7 @@ func TestSAuthToken_Encode(t *testing.T) {
 			t.Fatalf("SFernetKeyManager encrypt fail %s", err)
 		}
 
-		dtm := fm.Decrypt(ft, time.Hour)
+		dtm := fm.Decrypt(ft)
 		token2 := SAuthToken{}
 		err = token2.Decode(dtm)
 		if err != nil {
diff --git a/pkg/util/fernetool/fernet.go b/pkg/util/fernetool/fernet.go
index f1d1e713be..2ca45ea08b 100644
--- a/pkg/util/fernetool/fernet.go
+++ b/pkg/util/fernetool/fernet.go
@@ -82,7 +82,11 @@ func (m *SFernetKeyManager) LoadKeys(path string) error {
 	return nil
 }
 
-func (m *SFernetKeyManager) Decrypt(tok []byte, ttl time.Duration) []byte {
+func (m *SFernetKeyManager) Decrypt(tok []byte) []byte {
+	return m.VerifyAndDecrypt(tok, 0)
+}
+
+func (m *SFernetKeyManager) VerifyAndDecrypt(tok []byte, ttl time.Duration) []byte {
 	modReturned := len(tok) % 4
 	if modReturned > 0 {
 		for i := 0; i < 4-modReturned; i += 1 {
diff --git a/pkg/util/fernetool/fernet_test.go b/pkg/util/fernetool/fernet_test.go
index 79a78febea..0c57df4f68 100644
--- a/pkg/util/fernetool/fernet_test.go
+++ b/pkg/util/fernetool/fernet_test.go
@@ -17,7 +17,6 @@ package fernetool
 import (
 	"crypto/rand"
 	"testing"
-	"time"
 )
 
 func TestFernetKeys(t *testing.T) {
@@ -36,7 +35,7 @@ func TestFernetKeys(t *testing.T) {
 		if err != nil {
 			t.Fatalf("fail to encrypt %s", err)
 		}
-		omsg := m.Decrypt(msg, time.Hour)
+		omsg := m.Decrypt(msg)
 		if len(omsg) != msgLen {
 			t.Fatalf("descrupt fail %s", err)
 		}