diff --git a/cmd/cmsctl/main.go b/cmd/cmsctl/main.go
index 1b50fe1..87fa9d5 100644
--- a/cmd/cmsctl/main.go
+++ b/cmd/cmsctl/main.go
@@ -315,6 +315,9 @@ func runAuth(ctx context.Context, cfgPath string, cfg *Config, args []string, st
 		if cfg.AccessToken == "" {
 			return errors.New("no persisted access token; run auth login")
 		}
+		if !cfg.ExpiresAt.IsZero() && !time.Now().Before(cfg.ExpiresAt) {
+			return fmt.Errorf("persisted access token expired at %s; run auth login", cfg.ExpiresAt.Format(time.RFC3339))
+		}
 		if *raw {
 			_, err := fmt.Fprintln(stdout, cfg.AccessToken)
 			return err