diff --git a/src/database/User.cpp b/src/database/User.cpp
index fd35a866..15892136 100644
--- a/src/database/User.cpp
+++ b/src/database/User.cpp
@@ -49,6 +49,21 @@ AuthToken::create(Session& session, const std::string& value, const Wt::WDateTim
 	return res;
 }
 
+void
+AuthToken::removeExpiredTokens(Session& session, Wt::WDateTime now)
+{
+	session.checkUniqueLocked();
+
+	Wt::Dbo::collection<AuthToken::pointer> res = session.getDboSession().find<AuthToken>();
+
+	std::vector<AuthToken::pointer> expiredTokens;
+	for (auto& token : res)
+	{
+		if (token->_expiry < now)
+			token.remove();
+	}
+}
+
 AuthToken::pointer
 AuthToken::getByValue(Session& session, const std::string& value)
 {
diff --git a/src/ui/Auth.cpp b/src/ui/Auth.cpp
index 754a9768..9b500386 100644
--- a/src/ui/Auth.cpp
+++ b/src/ui/Auth.cpp
@@ -60,15 +60,21 @@ createAuthToken(Database::IdType userId)
 
 	const std::string secret {createSecret()};
 	const Wt::WDateTime now {Wt::WDateTime::currentDateTime()};
-	const Wt::WDateTime expiry {now.addYears(1)};
+	Wt::WDateTime expiry;
 
 	{
 		auto transaction {LmsApp->getDbSession().createUniqueTransaction()};
 
 		Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), userId)};
+		if (!user)
+			return;
+
+		expiry = user->isDemo() ? now.addDays(7) : now.addYears(1);
 		Database::AuthToken::create(LmsApp->getDbSession(), secret, expiry, user);
 
 		LMS_LOG(UI, DEBUG) << "Created auth token for user '" << user->getLoginName() << "', expiry = " << expiry.toString();
+
+		Database::AuthToken::removeExpiredTokens(LmsApp->getDbSession(), now);
 	}
 
 	LmsApp->setCookie(authCookieName,