diff --git a/app/Controllers/RestAuthenticationController.php b/app/Controllers/RestAuthenticationController.php
index 78ee61e..4573bbf 100755
--- a/app/Controllers/RestAuthenticationController.php
+++ b/app/Controllers/RestAuthenticationController.php
@@ -1977,7 +1977,7 @@ class RestAuthenticationController extends AdminController
         }
 
         $decoded = $result['decoded'];
-        $userId  = $decoded['id'] ?? null;
+        $userId  = $decoded['pre_hr_id'] ?? null;
 
         if (!$userId) {
             return $this->respond([
diff --git a/app/Filters/AuthJWT.php b/app/Filters/AuthJWT.php
index 4eac9e5..00d985d 100755
--- a/app/Filters/AuthJWT.php
+++ b/app/Filters/AuthJWT.php
@@ -115,9 +115,19 @@ class AuthJWT implements FilterInterface
         }
 
         // Refresh sliding expiration
-        $model->update($id, [
-            'token_time_out' => time() + getenv('TOKENTIMEOUT')
-        ]);
+        $newExpiry = time() + getenv('TOKENTIMEOUT');
+
+        if (!isset($decoded['emp_code'])) {
+            // HR user: refresh token_time_out across all branches (same mobile/email)
+            // so switching branches doesn't cause an unexpected expiry
+            $field = !empty($user['mobile']) ? 'mobile' : 'email';
+            $model->where($field, $user[$field])
+                  ->where('contact_type', 'client')
+                  ->where('is_active', 1)
+                  ->update(null, ['token_time_out' => $newExpiry]);
+        } else {
+            $model->update($id, ['token_time_out' => $newExpiry]);
+        }
 
         return true;
     }
diff --git a/app/Helpers/JWTToken.php b/app/Helpers/JWTToken.php
index f7b32ba..1715d54 100755
--- a/app/Helpers/JWTToken.php
+++ b/app/Helpers/JWTToken.php
@@ -137,7 +137,7 @@ class JWTToken
             $token = $jwtParts[0];
 
             try {
-                $decoded = JWT::decode($token, new Key("secret", 'HS512'));
+                $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS512'));
                 return json_encode(['status' => true, 'message' => 'Token is valid', 'data' =>$decoded->data->id ]);
             } catch (ExpiredException $e) {
                 return json_encode(['status' => false, 'message' => 'Token has expired']);
@@ -159,7 +159,7 @@ class JWTToken
         $jwtParts = explode(' ', $jwt);
         $token = $jwtParts[1];    
         
-        $decoded = JWT::decode($token, new Key("secret", 'HS512'));
+        $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS512'));
         return $decoded->id;
     }
 
@@ -170,7 +170,7 @@ class JWTToken
         $jwtParts = explode(' ', $jwt);
         $token = $jwtParts[1];    
         
-        $decoded = JWT::decode($token, new Key("secret", 'HS512'));
+        $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS512'));
         return $decoded->role;
     }
 
@@ -182,7 +182,7 @@ class JWTToken
         $jwtParts = explode(' ', $jwt);
         $token = $jwtParts[1];    
         
-        $decoded = JWT::decode($token, new Key("secret", 'HS512'));
+        $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS512'));
         return $decoded;
     }