grpc 1.73.0 → 1.75.0

data/src/core/config/core_configuration.cc

@@ -43,6 +43,7 @@ CoreConfiguration::CoreConfiguration(Builder* builder)
       channel_init_(builder->channel_init_.Build()),
       handshaker_registry_(builder->handshaker_registry_.Build()),
       channel_creds_registry_(builder->channel_creds_registry_.Build()),
+      call_creds_registry_(builder->call_creds_registry_.Build()),
       service_config_parser_(builder->service_config_parser_.Build()),
       resolver_registry_(builder->resolver_registry_.Build()),
       lb_policy_registry_(builder->lb_policy_registry_.Build()),
@@ -50,7 +51,9 @@ CoreConfiguration::CoreConfiguration(Builder* builder)
       certificate_provider_registry_(
           builder->certificate_provider_registry_.Build()),
       endpoint_transport_registry_(
-          builder->endpoint_transport_registry_.Build()) {}
+          builder->endpoint_transport_registry_.Build()),
+      auth_context_comparator_registry_(
+          builder->auth_context_comparator_registry_.Build()) {}
 
 void CoreConfiguration::RegisterBuilder(
     BuilderScope scope, absl::AnyInvocable<void(Builder*)> builder,

data/src/core/config/core_configuration.h

@@ -22,6 +22,7 @@
 
 #include "absl/functional/any_invocable.h"
 #include "absl/log/check.h"
+#include "src/core/credentials/call/call_creds_registry.h"
 #include "src/core/credentials/transport/channel_creds_registry.h"
 #include "src/core/credentials/transport/tls/certificate_provider_registry.h"
 #include "src/core/handshaker/handshaker_registry.h"
@@ -31,6 +32,7 @@
 #include "src/core/load_balancing/lb_policy_registry.h"
 #include "src/core/resolver/resolver_registry.h"
 #include "src/core/service_config/service_config_parser.h"
+#include "src/core/transport/auth_context_comparator_registry.h"
 #include "src/core/transport/endpoint_transport.h"
 #include "src/core/util/debug_location.h"
 
@@ -82,6 +84,10 @@ class GRPC_DLL CoreConfiguration {
       return &channel_creds_registry_;
     }
 
+    CallCredsRegistry<>::Builder* call_creds_registry() {
+      return &call_creds_registry_;
+    }
+
     ServiceConfigParser::Builder* service_config_parser() {
       return &service_config_parser_;
     }
@@ -106,6 +112,10 @@ class GRPC_DLL CoreConfiguration {
       return &endpoint_transport_registry_;
     }
 
+    AuthContextComparatorRegistry::Builder* auth_context_comparator_registry() {
+      return &auth_context_comparator_registry_;
+    }
+
    private:
     friend class CoreConfiguration;
 
@@ -113,12 +123,14 @@ class GRPC_DLL CoreConfiguration {
     ChannelInit::Builder channel_init_;
     HandshakerRegistry::Builder handshaker_registry_;
     ChannelCredsRegistry<>::Builder channel_creds_registry_;
+    CallCredsRegistry<>::Builder call_creds_registry_;
     ServiceConfigParser::Builder service_config_parser_;
     ResolverRegistry::Builder resolver_registry_;
     LoadBalancingPolicyRegistry::Builder lb_policy_registry_;
     ProxyMapperRegistry::Builder proxy_mapper_registry_;
     CertificateProviderRegistry::Builder certificate_provider_registry_;
     EndpointTransportRegistry::Builder endpoint_transport_registry_;
+    AuthContextComparatorRegistry::Builder auth_context_comparator_registry_;
 
     Builder();
     CoreConfiguration* Build();
@@ -241,6 +253,10 @@ class GRPC_DLL CoreConfiguration {
     return channel_creds_registry_;
   }
 
+  const CallCredsRegistry<>& call_creds_registry() const {
+    return call_creds_registry_;
+  }
+
   const ServiceConfigParser& service_config_parser() const {
     return service_config_parser_;
   }
@@ -265,6 +281,11 @@ class GRPC_DLL CoreConfiguration {
     return endpoint_transport_registry_;
   }
 
+  const AuthContextComparatorRegistry& auth_context_comparator_registry()
+      const {
+    return auth_context_comparator_registry_;
+  }
+
   static void SetDefaultBuilder(void (*builder)(CoreConfiguration::Builder*)) {
     default_builder_ = builder;
   }
@@ -292,12 +313,14 @@ class GRPC_DLL CoreConfiguration {
   ChannelInit channel_init_;
   HandshakerRegistry handshaker_registry_;
   ChannelCredsRegistry<> channel_creds_registry_;
+  CallCredsRegistry<> call_creds_registry_;
   ServiceConfigParser service_config_parser_;
   ResolverRegistry resolver_registry_;
   LoadBalancingPolicyRegistry lb_policy_registry_;
   ProxyMapperRegistry proxy_mapper_registry_;
   CertificateProviderRegistry certificate_provider_registry_;
   EndpointTransportRegistry endpoint_transport_registry_;
+  AuthContextComparatorRegistry auth_context_comparator_registry_;
 };
 
 template <typename Sink>

data/src/core/credentials/call/call_creds_registry.h

@@ -0,0 +1,125 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_REGISTRY_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_REGISTRY_H
+
+#include <map>
+#include <memory>
+#include <type_traits>
+#include <utility>
+
+#include "absl/strings/string_view.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_args.h"
+#include "src/core/util/ref_counted.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/validation_errors.h"
+
+struct grpc_call_credentials;
+
+namespace grpc_core {
+
+class CallCredsConfig : public RefCounted<CallCredsConfig> {
+ public:
+  virtual absl::string_view type() const = 0;
+
+  virtual bool Equals(const CallCredsConfig& other) const = 0;
+
+  virtual std::string ToString() const = 0;
+};
+
+template <typename T = grpc_call_credentials>
+class CallCredsFactory final {
+ public:
+  virtual ~CallCredsFactory() {}
+  virtual absl::string_view type() const = delete;
+  virtual RefCountedPtr<CallCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const = delete;
+  virtual RefCountedPtr<T> CreateCallCreds(
+      RefCountedPtr<CallCredsConfig> config) const = delete;
+};
+
+template <>
+class CallCredsFactory<grpc_call_credentials> {
+ public:
+  virtual ~CallCredsFactory() {}
+  virtual absl::string_view type() const = 0;
+  virtual RefCountedPtr<CallCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const = 0;
+  virtual RefCountedPtr<grpc_call_credentials> CreateCallCreds(
+      RefCountedPtr<CallCredsConfig> config) const = 0;
+};
+
+template <typename T = grpc_call_credentials>
+class CallCredsRegistry {
+ private:
+  using FactoryMap =
+      std::map<absl::string_view, std::unique_ptr<CallCredsFactory<T>>>;
+
+ public:
+  static_assert(std::is_base_of<grpc_call_credentials, T>::value,
+                "CallCredsRegistry must be instantiated with "
+                "grpc_call_credentials.");
+
+  class Builder {
+   public:
+    void RegisterCallCredsFactory(
+        std::unique_ptr<CallCredsFactory<T>> factory) {
+      absl::string_view type = factory->type();
+      factories_[type] = std::move(factory);
+    }
+    CallCredsRegistry Build() {
+      return CallCredsRegistry<T>(std::move(factories_));
+    }
+
+   private:
+    FactoryMap factories_;
+  };
+
+  bool IsSupported(absl::string_view type) const {
+    return factories_.find(type) != factories_.end();
+  }
+
+  RefCountedPtr<CallCredsConfig> ParseConfig(absl::string_view type,
+                                             const Json& config,
+                                             const JsonArgs& args,
+                                             ValidationErrors* errors) const {
+    const auto it = factories_.find(type);
+    if (it == factories_.cend()) return nullptr;
+    return it->second->ParseConfig(config, args, errors);
+  }
+
+  RefCountedPtr<T> CreateCallCreds(
+      RefCountedPtr<CallCredsConfig> config) const {
+    if (config == nullptr) return nullptr;
+    const auto it = factories_.find(config->type());
+    if (it == factories_.cend()) return nullptr;
+    return it->second->CreateCallCreds(std::move(config));
+  }
+
+ private:
+  explicit CallCredsRegistry(FactoryMap factories)
+      : factories_(std::move(factories)) {}
+
+  FactoryMap factories_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_REGISTRY_H

data/src/core/credentials/call/call_creds_registry_init.cc

@@ -0,0 +1,91 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <grpc/credentials.h>
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/support/json.h>
+
+#include <memory>
+#include <string>
+
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "src/core/config/core_configuration.h"
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/call/call_creds_registry.h"
+#include "src/core/credentials/call/jwt_token_file/jwt_token_file_call_credentials.h"
+#include "src/core/util/down_cast.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_args.h"
+#include "src/core/util/json/json_object_loader.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/validation_errors.h"
+
+namespace grpc_core {
+
+class JwtTokenFileCallCredsFactory : public CallCredsFactory<> {
+ public:
+  absl::string_view type() const override { return Type(); }
+
+  RefCountedPtr<CallCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const override {
+    return LoadFromJson<RefCountedPtr<Config>>(config, args, errors);
+  }
+
+  RefCountedPtr<grpc_call_credentials> CreateCallCreds(
+      RefCountedPtr<CallCredsConfig> base_config) const override {
+    auto* config = DownCast<const Config*>(base_config.get());
+    return MakeRefCounted<JwtTokenFileCallCredentials>(config->path());
+  }
+
+ private:
+  class Config : public CallCredsConfig {
+   public:
+    absl::string_view type() const override { return Type(); }
+
+    bool Equals(const CallCredsConfig& other) const override {
+      auto& o = DownCast<const Config&>(other);
+      return path_ == o.path_;
+    }
+
+    std::string ToString() const override {
+      return absl::StrCat("{path=\"", path_, "\"}");
+    }
+
+    const std::string& path() const { return path_; }
+
+    static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
+      static const auto* loader = JsonObjectLoader<Config>()
+                                      .Field("jwt_token_file", &Config::path_)
+                                      .Finish();
+      return loader;
+    }
+
+   private:
+    std::string path_;
+  };
+
+  static absl::string_view Type() { return "jwt_token_file"; }
+};
+
+void RegisterDefaultCallCreds(CoreConfiguration::Builder* builder) {
+  builder->call_creds_registry()->RegisterCallCredsFactory(
+      std::make_unique<JwtTokenFileCallCredsFactory>());
+}
+
+}  // namespace grpc_core

data/src/core/credentials/call/gcp_service_account_identity/gcp_service_account_identity_credentials.cc

@@ -16,23 +16,16 @@
 
 #include "src/core/credentials/call/gcp_service_account_identity/gcp_service_account_identity_credentials.h"
 
-#include <grpc/support/time.h>
-
 #include "absl/functional/any_invocable.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
-#include "absl/strings/escaping.h"
 #include "absl/strings/str_cat.h"
-#include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
 #include "src/core/call/metadata.h"
+#include "src/core/credentials/call/jwt_util.h"
 #include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/transport/status_conversion.h"
-#include "src/core/util/json/json.h"
-#include "src/core/util/json/json_args.h"
-#include "src/core/util/json/json_object_loader.h"
-#include "src/core/util/json/json_reader.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/uri.h"
@@ -88,51 +81,16 @@ class JwtTokenFetcherCallCredentials::HttpFetchRequest final
                                                self->response_.status)));
       return;
     }
+    // Return token object.
     absl::string_view body(self->response_.body, self->response_.body_length);
-    // Parse JWT token based on https://datatracker.ietf.org/doc/html/rfc7519.
-    // We don't do full verification here, just enough to extract the
-    // expiration time.
-    // First, split the 3 '.'-delimited parts.
-    std::vector<absl::string_view> parts = absl::StrSplit(body, '.');
-    if (parts.size() != 3) {
-      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
-      return;
-    }
-    // Base64-decode the payload.
-    std::string payload;
-    if (!absl::WebSafeBase64Unescape(parts[1], &payload)) {
-      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
-      return;
-    }
-    // Parse as JSON.
-    auto json = JsonParse(payload);
-    if (!json.ok()) {
-      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
+    auto expiration_time = GetJwtExpirationTime(body);
+    if (!expiration_time.ok()) {
+      self->on_done_(expiration_time.status());
       return;
     }
-    // Extract "exp" field.
-    struct ParsedPayload {
-      uint64_t exp = 0;
-
-      static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
-        static const auto kJsonLoader = JsonObjectLoader<ParsedPayload>()
-                                            .Field("exp", &ParsedPayload::exp)
-                                            .Finish();
-        return kJsonLoader;
-      }
-    };
-    auto parsed_payload = LoadFromJson<ParsedPayload>(*json, JsonArgs(), "");
-    if (!parsed_payload.ok()) {
-      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
-      return;
-    }
-    gpr_timespec ts = gpr_time_0(GPR_CLOCK_REALTIME);
-    ts.tv_sec = parsed_payload->exp;
-    Timestamp expiration_time = Timestamp::FromTimespecRoundDown(ts);
-    // Return token object.
     self->on_done_(MakeRefCounted<Token>(
         Slice::FromCopiedString(absl::StrCat("Bearer ", body)),
-        expiration_time));
+        *expiration_time));
   }
 
   OrphanablePtr<HttpRequest> http_request_;

data/src/core/credentials/call/jwt_token_file/jwt_token_file_call_credentials.cc

@@ -0,0 +1,86 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/credentials/call/jwt_token_file/jwt_token_file_call_credentials.h"
+
+#include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
+#include "src/core/credentials/call/jwt_util.h"
+#include "src/core/util/load_file.h"
+
+namespace grpc_core {
+
+class JwtTokenFileCallCredentials::FileReader final
+    : public TokenFetcherCredentials::FetchRequest {
+ public:
+  FileReader(JwtTokenFileCallCredentials* creds,
+             absl::AnyInvocable<void(
+                 absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+                 on_done)
+      : creds_(creds), on_done_(std::move(on_done)) {
+    creds->event_engine().Run([self = RefAsSubclass<FileReader>()]() {
+      ExecCtx exec_ctx;
+      self->ReadFile();
+    });
+  }
+
+  void Orphan() override {
+    // Can't really do anything to cancel in this case.
+    Unref();
+  }
+
+ private:
+  void ReadFile() {
+    auto contents = LoadFile(creds_->path_, /*add_null_terminator=*/false);
+    if (!contents.ok()) {
+      on_done_(absl::UnavailableError(contents.status().message()));
+      return;
+    }
+    absl::string_view body = contents->as_string_view();
+    auto expiration_time = GetJwtExpirationTime(body);
+    if (!expiration_time.ok()) {
+      on_done_(expiration_time.status());
+      return;
+    }
+    on_done_(MakeRefCounted<Token>(
+        Slice::FromCopiedString(absl::StrCat("Bearer ", body)),
+        *expiration_time));
+  }
+
+  JwtTokenFileCallCredentials* creds_;
+  absl::AnyInvocable<void(
+      absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+      on_done_;
+};
+
+std::string JwtTokenFileCallCredentials::debug_string() {
+  return absl::StrCat("JwtTokenFileCallCredentials(", path_, ")");
+}
+
+UniqueTypeName JwtTokenFileCallCredentials::Type() {
+  return GRPC_UNIQUE_TYPE_NAME_HERE("JwtTokenFile");
+}
+
+OrphanablePtr<TokenFetcherCredentials::FetchRequest>
+JwtTokenFileCallCredentials::FetchToken(
+    Timestamp /*deadline*/,
+    absl::AnyInvocable<
+        void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+        on_done) {
+  return MakeOrphanable<FileReader>(this, std::move(on_done));
+}
+
+}  // namespace grpc_core

data/src/core/credentials/call/jwt_token_file/jwt_token_file_call_credentials.h

@@ -0,0 +1,74 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_JWT_TOKEN_FILE_JWT_TOKEN_FILE_CALL_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_JWT_TOKEN_FILE_JWT_TOKEN_FILE_CALL_CREDENTIALS_H
+
+#include <grpc/credentials.h>
+#include <grpc/grpc_security.h>
+
+#include <string>
+
+#include "absl/functional/any_invocable.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/call/token_fetcher/token_fetcher_credentials.h"
+#include "src/core/util/orphanable.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/time.h"
+#include "src/core/util/unique_type_name.h"
+
+namespace grpc_core {
+
+// JWT token file call credentials.
+// See gRFC A97 (https://github.com/grpc/proposal/pull/492).
+class JwtTokenFileCallCredentials : public TokenFetcherCredentials {
+ public:
+  explicit JwtTokenFileCallCredentials(
+      absl::string_view path,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr)
+      : TokenFetcherCredentials(std::move(event_engine)), path_(path) {}
+
+  std::string debug_string() override;
+
+  static UniqueTypeName Type();
+
+  UniqueTypeName type() const override { return Type(); }
+
+  absl::string_view path() const { return path_; }
+
+ private:
+  class FileReader;
+
+  OrphanablePtr<FetchRequest> FetchToken(
+      Timestamp /*deadline*/,
+      absl::AnyInvocable<
+          void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+          on_done) final;
+
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return QsortCompare(static_cast<const grpc_call_credentials*>(this), other);
+  }
+
+  std::string path_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_JWT_TOKEN_FILE_JWT_TOKEN_FILE_CALL_CREDENTIALS_H

data/src/core/credentials/call/jwt_util.cc

@@ -0,0 +1,70 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/credentials/call/jwt_util.h"
+
+#include <grpc/support/time.h>
+
+#include <string>
+#include <vector>
+
+#include "absl/status/status.h"
+#include "absl/strings/escaping.h"
+#include "absl/strings/str_split.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_args.h"
+#include "src/core/util/json/json_object_loader.h"
+#include "src/core/util/json/json_reader.h"
+
+namespace grpc_core {
+
+absl::StatusOr<Timestamp> GetJwtExpirationTime(absl::string_view jwt) {
+  // First, split the 3 '.'-delimited parts.
+  std::vector<absl::string_view> parts = absl::StrSplit(jwt, '.');
+  if (parts.size() != 3) {
+    return absl::UnauthenticatedError("error parsing JWT token");
+  }
+  // Base64-decode the payload.
+  std::string payload;
+  if (!absl::WebSafeBase64Unescape(parts[1], &payload)) {
+    return absl::UnauthenticatedError("error parsing JWT token");
+  }
+  // Parse as JSON.
+  auto json = JsonParse(payload);
+  if (!json.ok()) {
+    return absl::UnauthenticatedError("error parsing JWT token");
+  }
+  // Extract "exp" field.
+  struct ParsedPayload {
+    uint64_t exp = 0;
+
+    static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
+      static const auto kJsonLoader = JsonObjectLoader<ParsedPayload>()
+                                          .Field("exp", &ParsedPayload::exp)
+                                          .Finish();
+      return kJsonLoader;
+    }
+  };
+  auto parsed_payload = LoadFromJson<ParsedPayload>(*json, JsonArgs(), "");
+  if (!parsed_payload.ok()) {
+    return absl::UnauthenticatedError("error parsing JWT token");
+  }
+  gpr_timespec ts = gpr_time_0(GPR_CLOCK_REALTIME);
+  ts.tv_sec = parsed_payload->exp;
+  return Timestamp::FromTimespecRoundDown(ts);
+}
+
+}  // namespace grpc_core

data/src/core/credentials/call/jwt_util.h

@@ -0,0 +1,32 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_JWT_UTIL_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_JWT_UTIL_H
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "src/core/util/time.h"
+
+namespace grpc_core {
+
+// Extract the expiration time from a JWT token based on
+// https://datatracker.ietf.org/doc/html/rfc7519.
+absl::StatusOr<Timestamp> GetJwtExpirationTime(absl::string_view jwt);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_JWT_UTIL_H