When using GoogleCredential.getApplicationDefault, the credentials are cached in DefaultCredentialProvider (code).
This is an issue for long lived programs where the application defaults may change. One example is the Gradle wrapper (see gradle/gradle#31652 (comment)).
It would be nice if GoogleCredential could be instanciated so that we could manage its lifecycle.