question

I have implemented the Clover Authentication for the sandbox environment through a separate server app and then making request with the SDK generated token to that server app from the clover android app I'm building as well.

This is the method that does that;

private fun getCloverToken(callback: (String?) -> Unit) {
    account = CloverAccount.getAccount(this)

    object : AsyncTask<Void?, Void?, CloverAuth.AuthResult?>() {
        @Deprecated("Deprecated in Java")
        override fun doInBackground(vararg params: Void?): CloverAuth.AuthResult? {
            try {
                val context: Context = applicationContext
                return CloverAuth.authenticate(context)
            } catch (e: Exception) {
                Log.e(TAG, "getCloverToken()/doInBackground: $e")
            }
            return null
        }

        @Deprecated("Deprecated in Java")
        override fun onPostExecute(cloverAuth: CloverAuth.AuthResult?) {
            super.onPostExecute(cloverAuth)

            if (!isFinishing) {
                if (cloverAuth?.authToken != null) {
                    val cloverAccountToken = cloverAuth.authToken.toString()
                    callback(cloverAccountToken)
                } else {
                    Log.e(TAG, "getCloverToken()/onPostExecute: Error retrieving token.")
                    Toast(applicationContext).showCustomToast(getString(R.string.no_clover_account), this@MainActivity)
                    callback(null)
                }
            }
        }
    }.execute()
}

While everything was working previously, I am now experiencing issues with the authentication token. Specifically, the token is sometimes being returned even after it has expired, causing authentication to fail after 5 days or more.

Note that I'm not controlling the token expiration in the server app. I'm relying entirely on clover for validating and generating tokens. When a request is submitted with a clover token, I send a test call to the clover api to verify the token. If it's good, I allow the request.