In my fast api server, it subscribes to the google realtime developer notifications.

python version 3.12.7 "google-cloud-pubsub (>=2.29.0,<3.0.0)"

The subscriber can be successfully initialized as below:

            # self.credentials is a dict from google service account credential json file
            self.subscriber = pubsub_v1.SubscriberClient.from_service_account_info(
                self.credentials) 

and used like this:

            self._streaming_pull_future = self.subscriber.subscribe(
                self.subscription_path,
                callback=callback,
                flow_control=flow_control,
            )
            logger.info(f"Listening for messages on {self.subscription_path}")

            while self._running:
                try:
                    if self._streaming_pull_future.done():
                        break
                    await asyncio.sleep(1)
                except asyncio.CancelledError:
                    break

The subscriber client can initialized, successfully pulling and ack the messages. However, after about 30 minute, it throw out the error:

Error in notification worker: 401 Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See . [reason: "ACCESS_TOKEN_EXPIRED"
domain: "googleapis"
metadata {
  key: "service"
  value: "pubsub.googleapis"
}
metadata {
  key: "method"
  value: "google.pubsub.v1.Subscriber.StreamingPull"
}
]

The error indicates the access token has timed out. I have several questions: Is there a way to initialize the subscriber client so that it can automatically refresh the token itself? If not, what is the good practice that developer explicitly refresh the token, pass it to the subscriber?