@@ -327,7 +327,7 @@ async def test_stored_token_is_reused_without_reauthorizing() -> None:
 
 @pytest.mark.anyio
 async def test_stored_token_is_not_sent_at_its_expiry_instant() -> None:
-    """A stored token whose expiry equals the current time is already expired, so it is not attached."""
+    """SDK-defined: a token is expired at its `expires_in` deadline, like a JWT `exp` (RFC 7519 §4.1.4)."""
     requests: list[httpx2.Request] = []
     storage = InMemoryStorage(tokens=OAuthToken(access_token="cached", token_type="Bearer", expires_in=0))
     auth = make_provider(storage)
 
@@ -244,11 +244,6 @@ async def test_token_validity_checking(self, oauth_provider: OAuthClientProvider
         assert not context.is_token_valid()
         assert context.can_refresh_token()  # Can still refresh
 
-        # At the expiry instant itself the token is already expired (RFC 7519 §4.1.4)
-        with mock.patch("time.time", return_value=1_800_000_000.0):
-            context.token_expiry_time = 1_800_000_000.0
-            assert not context.is_token_valid()
-
         # Remove refresh token
         context.current_tokens.refresh_token = None
         assert not context.can_refresh_token()
@@ -3672,3 +3667,13 @@ async def echo_callback() -> AuthorizationCodeResult:
         await auth_flow.asend(httpx2.Response(200, request=final_req))
     except StopAsyncIteration:
         pass
+
+
+def test_a_token_is_invalid_at_its_expiry_instant(oauth_provider: OAuthClientProvider):
+    """SDK-defined: the deadline from `expires_in` is exclusive, like a JWT `exp` (RFC 7519 §4.1.4)."""
+    context = oauth_provider.context
+    with mock.patch("time.time", return_value=1_800_000_000.0):
+        token = OAuthToken(access_token="t", token_type="Bearer", expires_in=0)
+        context.current_tokens = token
+        context.update_token_expiry(token)
+        assert not context.is_token_valid()