But the service account/role can only request a new token if it provides its nlauth credentials, which i'm sure have long expired by now (since it's using tokens)