exp is a NumericDate: seconds since 1970-01-01T00:00:00Z, ignoring leap seconds, not milliseconds (a value with 13 digits is a common bug from JavaScript's Date.now()). The token is invalid when the current time is at or after exp; verifiers may allow a small leeway, usually a minute or two, for clock skew. Companion claims are nbf (not before) and iat (issued at).
Keep access tokens short-lived (minutes) because bearer tokens cannot be recalled once issued, and use refresh tokens or re-authentication for longevity. Errors such as jwt expired or Signature has expired mean the verifier compared exp with its clock; check both clocks before blaming the issuer.