Full title: How to dynamically refresh Google OAuth Token using JWT Service Account in ODC to fix 401 Unauthorized on first click? 

Hi Experts,

We are building an automated interview scheduling feature in OutSystems Developer Cloud (ODC) using the Google Calendar API. We are using a Google Service Account with Domain-Wide Delegation enabled so the system can impersonate our corporate HR calendar.

Our Logic Flow inside the TokensGoogle Server Action:

1. We use GenerateJwtFromPemString by passing our Google Private Key string to generate a signed JWT assertion.

2. We then call a REST API (GetAccessToken) to exchange this JWT assertion for a dynamic Google Access Token (ya29.c...).

3. Finally, the generated token is passed down to a core shared Service Action (CreateCalendarEvent) from a consumer module (GoogleCalendarIntegrationService) to insert the event.

The Core Problem:

Every time a user opens the screen and clicks the "Send Invitation" button for the very first time (First Click), the application throws a 401 Unauthorized / Invalid Credentials Error from the Google API side.

However, if we manually refresh the browser page or manually generate/paste a token from the Google Developer Console, it WORKS 100% PERFECTLY on the next clicks—the calendar slot is booked, and email invitations are successfully sent to the applicant.

Our Debugger Findings:

When we inspected the runtime using the debugger on the first click, we noticed that GetAccessToken actually retrieves a fresh ya29. token string from Google. However, the custom wrapper's output boolean issuccess flags as false, causing the output variable to return empty. It only binds correctly after a page refresh or manual reset.

My Questions for the Forum:

1. Since we are using a JWT Service Account flow (which does not use a traditional OAuth2 refresh_token), what is the best practice in OutSystems to dynamically refresh and sign a new JWT assertion on every single button click so that the first click never uses a cached/stale state?

2. How should we dynamically compute the IssuedAt (iat) and Expiration (exp) claims inside the OutSystems logic to force Google to accept the token instantly on the first hit without needing a manual screen refresh?

Any sample logic or guidance on achieving a flawless dynamic token refresh using JWT in ODC would be a lifesaver. Thank you!