What happens when FastAPI's OAuth2PasswordBearer receives an expired JWT that still satisfies required scopes?

When protecting an endpoint with FastAPI's OAuth2PasswordBearer dependency, developers often rely on the token's scope claim to enforce least‑privilege access while also expecting the library to reject expired credentials via the exp claim. The exact point at which FastAPI validates scopes relative to expiration is not documented, leaving uncertainty about whether a token that satisfies all required scopes but carries an expired exp will trigger a scope‑based failure, an expiration‑based failure, or a combined response.

This ambiguity affects debugging and the design of custom error handling, especially when distinguishing between a merely expired token and one that lacks sufficient privileges.

What is the order of validation performed by OAuth2PasswordBearer for scope and expiration checks? Does a token with valid scopes but an expired exp produce a 401 Unauthorized, a 403 Forbidden, or a different status? Can the validation sequence be altered or extended without replacing the dependency?