public static OAuthBearerValidationResult validateIssuedAt(OAuthBearerUnsecuredJws jwt, boolean required,
            long whenCheckTimeMs, int allowableClockSkewMs) throws OAuthBearerConfigException {
        Number value;
        try {
            value = Objects.requireNonNull(jwt).issuedAt();
        } catch (OAuthBearerIllegalTokenException e) {
            return e.reason();
        }
        boolean exists = value != null;
        if (!exists)
            return doesNotExistResult(required, "iat");
        double doubleValue = value.doubleValue();
        return 1000 * doubleValue > whenCheckTimeMs + confirmNonNegative(allowableClockSkewMs)
                ? OAuthBearerValidationResult.newFailure(String.format(
                        "The Issued At value (%f seconds) was after the indicated time (%d ms) plus allowable clock skew (%d ms)",
                        doubleValue, whenCheckTimeMs, allowableClockSkewMs))
                : OAuthBearerValidationResult.newSuccess();
    }
Validate the 'iat' (Issued At) claim. It can be required to exist in the
given claims, and if it exists it must be a (potentially fractional) number
of seconds since the epoch defining when the JWT was issued; it is a
validation error if the Issued At time is after the time at which the check
is being done (plus any allowable clock skew).

@param jwt
           the mandatory JWT to which the validation will be applied
@param required
           true if the claim is required to exist
@param whenCheckTimeMs
           the time relative to which the validation is to occur
@param allowableClockSkewMs
           non-negative number to take into account some potential clock skew
@return the result of the validation
@throws OAuthBearerConfigException
            if the given allowable clock skew is negative
clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/unsecured/OAuthBearerValidationUtils.java