If git-lfs attempts to download files after the authentication token acquired from git-lfs-authenticate over SSH expires (e.g., when cloning a large repository and it takes longer than 5 - 10 minutes) it will get unauthorized errors.

Git LFS has a mechanism to automatically renew the token but it requires the expire_in field to be set.

As can be seen on https://github.com/git-lfs/git-lfs/blob/master/docs/api/authentication.md the expires_in field is optional, however it is likely only optional because tokens don't necessarily expire in certain implementations however they do in Bitbucket Server.

The fix is to set the expires_in field in the JSON to the same value of 'Batch Token Expiry'.