public static OAuthBearerValidationResult validateExpirationTime(OAuthBearerUnsecuredJws jwt, long whenCheckTimeMs,
            int allowableClockSkewMs) throws OAuthBearerConfigException {
        Number value;
        try {
            value = Objects.requireNonNull(jwt).expirationTime();
        } catch (OAuthBearerIllegalTokenException e) {
            return e.reason();
        }
        boolean exists = value != null;
        if (!exists)
            return doesNotExistResult(true, "exp");
        double doubleValue = value.doubleValue();
        return whenCheckTimeMs - confirmNonNegative(allowableClockSkewMs) >= 1000 * doubleValue
                ? OAuthBearerValidationResult.newFailure(String.format(
                        "The indicated time (%d ms) minus allowable clock skew (%d ms) was on or after the Expiration Time value (%f seconds)",
                        whenCheckTimeMs, allowableClockSkewMs, doubleValue))
                : OAuthBearerValidationResult.newSuccess();
    }
Validate the 'exp' (Expiration Time) claim. It must exist and it must be a
(potentially fractional) number of seconds defining the point at which the
JWT expires. It is a validation error if the time at which the check is being
done (minus any allowable clock skew) is on or after the Expiration Time
time.

@param jwt
           the mandatory JWT to which the validation will be applied
@param whenCheckTimeMs
           the time relative to which the validation is to occur
@param allowableClockSkewMs
           non-negative number to take into account some potential clock skew
@return the result of the validation
@throws OAuthBearerConfigException
            if the given allowable clock skew is negative
clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/unsecured/OAuthBearerValidationUtils.java