How to use of WIF token in an applicaiton workload running outside gcp e g Quarkus app onprem putting messages to pubsub

Question

I have a utility to get WIF-token for a service account sa1 : e.g getWif(idp.client, idp.secret, gcp.projNum, "sa1@projx.iam.gsrviceaccount.com", "myIdpPool", "myIdpApp")

I set that wif/access token in env variable and start my quarkus application (outside gcp, e.g laptop, or onpremserver)

Questions:

1. Is this the "right way" to make use of WIF-token for apps running outside GCP?

2. Is there some utility/feature in gcp-libraries to refresh the wif token if necessary? E.g Hooking a token-refresher function to com.google.api.gax.core.CredentialsProvider