Well if you have forever sessions turned on, and the token has expired, then the system shouldn't let you perform API actions without first refreshing the token.
UNLESS you have a default role associated with the API Key being used in the calls. Then it's possible (likely?) that the call goes through based on the default role, rather than on the user's role, thus yielding a 0 for user_id.
Am I on the right track?