diff --git a/README.md b/README.md
index 203528c..91d35d1 100644
--- a/README.md
+++ b/README.md
@@ -145,6 +145,7 @@ item | default value | description
 BNB_PORT | 4534 | Default http port for bonob to listen on
 BNB_URL | http://$(hostname):4534 | URL (including path) for bonob so that sonos devices can communicate. **This must be either the public IP or DNS entry of the bonob instance so that the sonos devices can communicate with it.**
 BNB_SECRET | bonob | secret used for encrypting credentials
+BNB_AUTH_TIMEOUT | 1h | Timeout for the sonos auth token, described in the format [ms](https://github.com/vercel/ms), ie. '5s' == 5 seconds, '11h' == 11 hours.  In the case of using Navidrome this should be less than the value for ND_SESSIONTIMEOUT
 BNB_SONOS_AUTO_REGISTER | false | Whether or not to try and auto-register on startup
 BNB_SONOS_DEVICE_DISCOVERY | true | Enable/Disable sonos device discovery entirely.  Setting this to 'false' will disable sonos device search, regardless of whether a seed host is specified.
 BNB_SONOS_SEED_HOST | undefined | sonos device seed host for discovery, or ommitted for for auto-discovery
diff --git a/src/app.ts b/src/app.ts
index 40f458c..c9f5a9b 100644
--- a/src/app.ts
+++ b/src/app.ts
@@ -21,7 +21,7 @@ import { JWTSmapiLoginTokens } from "./smapi_auth";
 const config = readConfig();
 const clock = SystemClock;
 
-logger.info(`Starting bonob with config ${JSON.stringify(config)}`);
+logger.info(`Starting bonob with config ${JSON.stringify({ ...config, secret: "*******" })}`);
 
 const bonob = bonobService(
   config.sonos.serviceName,
@@ -89,7 +89,7 @@ const app = server(
     applyContextPath: true,
     logRequests: true,
     version,
-    smapiAuthTokens: new JWTSmapiLoginTokens(clock, config.secret, '1h'),
+    smapiAuthTokens: new JWTSmapiLoginTokens(clock, config.secret, config.authTimeout),
     externalImageResolver: artistImageFetcher
   }
 );
diff --git a/src/config.ts b/src/config.ts
index f9f2dbc..7609e7c 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -63,6 +63,7 @@ export default function () {
     port,
     bonobUrl: url(bonobUrl),
     secret: bnbEnvVar("SECRET", { default: "bonob" })!,
+    authTimeout: bnbEnvVar("AUTH_TIMEOUT", { default: "1h" })!,
     icons: {
       foregroundColor: bnbEnvVar("ICON_FOREGROUND_COLOR", {
         validationPattern: COLOR,
diff --git a/tests/config.test.ts b/tests/config.test.ts
index 50afd52..d374038 100644
--- a/tests/config.test.ts
+++ b/tests/config.test.ts
@@ -262,6 +262,17 @@ describe("config", () => {
     });
   });
 
+  describe("authTimeout", () => {
+    it("should default to 1h", () => {
+      expect(config().authTimeout).toEqual("1h");
+    });
+
+    it(`should be overridable using BNB_AUTH_TIMEOUT`, () => {
+      process.env["BNB_AUTH_TIMEOUT"] = "33s";
+      expect(config().authTimeout).toEqual("33s");
+    });
+});
+
   describe("sonos", () => {
     describe("serviceName", () => {
       it("should default to bonob", () => {