OAUTH authorization expired tokens

Hello,

I've setup karapace rest proxy, connected to streamzi kafka cluster with oauth configured (keycloak). Commiting to topic works as expected, but if traffic is commited with a token near expiry, tokens never get discarded and proxy keeps logging FATAL error. I've would assume this token should be deleted?

Error log loops forever stating:

%3|1746619473.030|FAIL|rdkafka#producer-8| [thrd:sasl_plaintext://kafka-test-cluster-controller-1.kafka-test-clu]: sasl_plaintext://kafka-test-cluster-controller-1.kafka-test-cluster-kafka-brokers.kafka.svc:9093/1: SASL authentication error: Token expired at: 1746619175000 (2025-05-07T11:59:35 UTC) (ErrId: 9313eba6) (after 302ms in state AUTH_REQ)
%3|1746619473.300|FAIL|rdkafka#producer-11| [thrd:sasl_plaintext://kafka-test-cluster-controller-2.kafka-test-clu]: sasl_plaintext://kafka-test-cluster-controller-2.kafka-test-cluster-kafka-brokers.kafka.svc:9093/2: SASL authentication error: Token expired at: 1746619175000 (2025-05-07T11:59:35 UTC) (ErrId: 17a5d64e) (after 302ms in state AUTH_REQ)
%3|1746619473.458|FAIL|rdkafka#producer-10| [thrd:sasl_plaintext://kafka-test-cluster-controller-1.kafka-test-clu]: sasl_plaintext://kafka-test-cluster-controller-1.kafka-test-cluster-kafka-brokers.kafka.svc:9093/1: SASL authentication error: Token expired at: 1746619175000 (2025-05-07T11:59:35 UTC) (ErrId: d7d83122) (after 302ms in state AUTH_REQ)

I see logged producer close, but tokens never cleared.

karapace.kafka_rest_apis MainThread WARNING Releasing unused connection for UserRestProxy(username=None) due to token expiry at 2025-05-07 11:59:35+00:00
karapace.kafka_rest_apis MainThread INFO Disposing async producer

Tried develop and latest stable version (4.1.2.). Running in Talos kubernetes cluster fronted with Apisix+authz-keycloak.

Have I missed some part of the puzzle?

Best regards, Primož

ps:
- name: KARAPACE_KARAPACE_REST
value: "TRUE"
- name: KARAPACE_PORT
value: "8082"
- name: KARAPACE_HOST
value: "0.0.0.0"
- name: KARAPACE_SECURITY_PROTOCOL
value: "SASL_PLAINTEXT"
- name: KARAPACE_SASL_MECHANISM
value: "OAUTHBEARER"
- name: KARAPACE_SASL_OAUTH_TOKEN_PROVIDER
value: "TokenWithExpiryProvider"
- name: KARAPACE_REST_AUTHORIZATION
value: "TRUE"
- name: KARAPACE_SASL_BOOTSTRAP_URI
value: "kafka-test-cluster-kafka-bootstrap:9093"
- name: KARAPACE_LOG_LEVEL
value: "DEBUG"
- name: KARAPACE_KAFKA_RETRIABLE_ERRORS_SILENCED
value: "FALSE"