Add a consistent 5 minute clock skew accomodation (#145)
diff --git a/google/auth/credentials.py b/google/auth/credentials.py
index 8570957..6fb89d8 100644
--- a/google/auth/credentials.py
+++ b/google/auth/credentials.py
@@ -56,8 +56,10 @@
Note that credentials can be invalid but not expired becaue Credentials
with :attr:`expiry` set to None is considered to never expire.
"""
- now = _helpers.utcnow()
- return self.expiry is not None and self.expiry <= now
+ # Err on the side of reporting expiration early so that we avoid
+ # the 403-refresh-retry loop.
+ adjusted_now = _helpers.utcnow() - _helpers.CLOCK_SKEW
+ return self.expiry is not None and self.expiry <= adjusted_now
@property
def valid(self):