Reset gcloud auth identity token? - authentication

Question

I'm working on a gcloud service which is not publicly available, i.e. you need to connect to it with your Authorization Header set with your gcloud identity token.
The docs used curl to show how to use it from the command line, however as my case concerns a web application I used a browser extension to inject this header when connecting to pages.
Silly me, I forgot to turn if off after I was done, which resulted in accessing a few websites with that token set in the request header. This means some third parties may now have that code.
2 questions concerning this:
How bad is this? What can this token be used for by the ill-willed?
How can I reset/revoke/renew this token?

Answer 1

Identity Tokens are JWTs and are bearer tokens (as you are undoubtedly aware) and generally include a short-ish (60 minute) expiry.
As you suggest, you should be very careful with them as they could be used unscrupulously (while valid).
You may query your JWT using a (trustworthy!) tool to check the expiry:
E.g https://jwt.io/
I'm unsure (doesn't mean that there isn't) whether there's a way to forcibly expire Google-issued JWTs
Update:
Spoke with a Googler who's very well informed on auth and he confirmed that you must await expiry.
Update:
Independently, I reminded myself that Google has a( very trustworthy) endpoint to verify tokens too (I can just never remember the URL, but) it's:
TOKEN=$(gcloud auth print-identity-token)
curl \
--request GET \
https://oauth2.googleapis.com/tokeninfo?id_token=${TOKEN}
And, for completeness, for access tokens:
TOKEN=$(gcloud auth print-access-token)
curl \
--request GET \
https://oauth2.googleapis.com/tokeninfo?access_token=${TOKEN}