Token expiration in JWT is defined using the ‘exp’ claim, which indicates the time after which the token is no longer valid. This is crucial for security because it limits the window of opportunity for an attacker to use a stolen token, ensuring that access is only granted for a specific duration.