MSAL Python 1.36.0 interactive authentication returns HTTP 200 with expires_in=0 — documented meaning and supported validity handling?

We use MSAL Python 1.36.0 interactive authentication with a browser-based authorization-code/PKCE flow to obtain a Microsoft Entra access token for Azure Database for PostgreSQL.

The client uses an in-memory token cache, disables the Windows broker and excludes the offline_access scope. No tokens or raw authentication responses are retained.

A single controlled attempt produced these categorical observations:

• Browser authentication completed.
• Token-endpoint response: HTTP 200.
• Response body: valid JSON.
• Independent parsing of the response before returning it unchanged to MSAL found expires_in present as integer 0.
• The final MSAL result also contained expires_in as integer 0.
• Boundary and final expiry metadata matched.
• The client rejected zero expiry and stopped before any PostgreSQL connection.
• HTTP cleanup succeeded.

This establishes that zero was present before final MSAL result handling. We are not asserting that the access token itself had zero actual lifetime.

Questions:

1. Does expires_in=0 in a successful token response have a documented meaning for this interactive flow?
2. Is this a recognized Microsoft identity-platform or MSAL behavior? What documented conditions can produce it?
3. When expires_in is zero, is there a Microsoft-supported way to establish access-token expiration and sufficient remaining validity without inventing a duration or simply ignoring the value?
4. If another metadata source or token-validation method is supported, what validation requirements and limitations apply, particularly for Azure Database for PostgreSQL?
5. Should a security-sensitive client continue rejecting the response unless those requirements can be satisfied?

Please provide authoritative Microsoft documentation or an official issue reference where available. We seek a minimum supported correction to the existing flow, not a replacement authentication architecture.

No account, tenant, application or resource identifiers, credentials, tokens, authorization codes, raw responses or screenshots are included.