diff --git a/data/model/appspecifictoken.py b/data/model/appspecifictoken.py
index 282fa458c..6b0921bd0 100644
--- a/data/model/appspecifictoken.py
+++ b/data/model/appspecifictoken.py
@@ -60,7 +60,8 @@ def get_expiring_tokens(user, soon):
   return (AppSpecificAuthToken
           .select()
           .where(AppSpecificAuthToken.user == user,
-                 AppSpecificAuthToken.expiration <= soon_datetime))
+                 AppSpecificAuthToken.expiration <= soon_datetime,
+                 AppSpecificAuthToken.expiration > datetime.now()))
 
 
 def gc_expired_tokens(user):
diff --git a/static/directives/quay-message-bar.html b/static/directives/quay-message-bar.html
index ccf3ca2ce..bc40929f1 100644
--- a/static/directives/quay-message-bar.html
+++ b/static/directives/quay-message-bar.html
@@ -2,7 +2,7 @@
   <div ng-repeat="token in NotificationService.expiringAppTokens">
     <div class="quay-service-status-description warning">
        Your external application token <strong style="display: inline-block; padding: 4px;">{{ token.title }}</strong>
-       will be expiring <strong style="display: inline-block; padding: 4px;"><time-ago datetime="token.expiration"></time-ago></strong>.
+       will be expiring in <strong style="display: inline-block; padding: 4px;"><time-ago datetime="token.expiration"></time-ago></strong>.
        Please create a new token and revoke this token in user settings.
     </div>
   </div>