do you know when it is not base64 encoded ? wondering if this is the right handling or if we should throw an IllegalStateException or something

Hi @singhpk234 Thanks for taking a look!

so GCP bearer access tokens are opaque and not base64 encoded, so it's not possible to extract the expire time from them.

For user bearer tokens things work because they are only composed by 2 parts, they are prefixed with only ya29 but for service accounts they have ya29.c which leads to this issue, where I need to catch the IllegalArgumentException otherwise I can't pass the token to the server.

As is, expiresAtMillis extracting logic only makes sense for JWT tokens and it returns null when it fails do decode the payload , IOException, so catching the IllegalArgumentException thrown by the Base64 decoder also makes sense to me and should be ok.

let me know