I suppose the method can have an additional argument verify=by default set to True but could also be a dict like:

{
"secure_protocol": True/False
"token_type": True/False,
"access_token": True/False,
"expire_at": True/False
}

A little bit alà pyJWT https://pyjwt.readthedocs.io/en/latest/usage.html#reading-the-claimset-without-validation

Thoughts?

I suppose the method can have an additional argument verify=by default set to True but could also be a dict like:

{
"secure_protocol": True/False
"token_type": True/False,
"access_token": True/False,
"expire_at": True/False
}

A little bit alà pyJWT https://pyjwt.readthedocs.io/en/latest/usage.html#reading-the-claimset-without-validation

Thoughts?

That doesn't seem necessary to me, the existing add_token method is fine as it is. I don't think there's a good reason not to check the expiration time when adding the token.
What I'm proposing is simply making the expiration check a regular method that is available to someone using the library. The advantage of that approach is that the expiration check can be done directly without the try/catch.
For example instead of this kind of code

try:
    client.add_token(url)
except TokenExpired:
    authenticate(client)
    client.add_token(url)

It might look like this

if client.is_expired():
    authenticate(client)
client.add_token(url)

Which seems a bit cleaner to me.

The problem with this approach is twofold:

• It becomes incompatible with previous interface
• Using Exception to return different states of a calling functions, is more a style question than something else, but that should be applied to the project as a whole. Since oauthlib has started to use Exception mechanisms to return these states, I'm not sure it's worth to change it now.

Any Thoughts?

The problem with this approach is twofold:

• It becomes incompatible with previous interface
• Using Exception to return different states of a calling functions, is more a style question than something else, but that should be applied to the project as a whole. Since oauthlib has started to use Exception mechanisms to return these states, I'm not sure it's worth to change it now.

Any Thoughts?

I'm not arguing for moving everybody to that approach, the same check will occur with the same exception so I'm not sure how the interface is different. I'm just requesting that the check be put in a visible method in case someone wanted to check it themselves.

Ah sure, then I don't have objections, it seems a reasonable PR :)