Actually the quarkus.oidc.token.lifespan-grace=60 is doing the work as expected. Current time is allowed to be later than token expiration time by at most the configured number of seconds.

In my case this was not working because I was overriding the configuration using the implements TenantConfigResolver so I had to add the equivalent there config.getToken().setLifespanGrace(60);