You can pass the "now" time into the function which verifies the expiry (and obviously also the function which creates the credentials). The test function calls it with a hard-coded time, and the production function calls it with the actual current time. For example:
def validate_expiry(credentials, now):
return credentials.expiry > now