diff --git a/internal/token.go b/internal/token.go
index 955d5a0..83f7847 100644
--- a/internal/token.go
+++ b/internal/token.go
@@ -11,6 +11,7 @@
 	"fmt"
 	"io"
 	"io/ioutil"
+	"math"
 	"mime"
 	"net/http"
 	"net/url"
@@ -90,6 +91,9 @@
 	if err != nil {
 		return err
 	}
+	if i > math.MaxInt32 {
+		i = math.MaxInt32
+	}
 	*e = expirationTime(i)
 	return nil
 }
diff --git a/internal/token_test.go b/internal/token_test.go
index d8373c2..c54095a 100644
--- a/internal/token_test.go
+++ b/internal/token_test.go
@@ -6,7 +6,9 @@
 
 import (
 	"context"
+	"fmt"
 	"io"
+	"math"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -62,3 +64,14 @@
 		t.Errorf("RetrieveToken (with cancelled context) = nil; want error")
 	}
 }
+
+func TestExpiresInUpperBound(t *testing.T) {
+	var e expirationTime
+	if err := e.UnmarshalJSON([]byte(fmt.Sprint(int64(math.MaxInt32) + 1))); err != nil {
+		t.Fatal(err)
+	}
+	const want = math.MaxInt32
+	if e != want {
+		t.Errorf("expiration time = %v; want %v", e, want)
+	}
+}