Fix Dag processor token docs and renewal test flakiness

Slow CI responses can exceed the best-effort renewal deadline, while the authentication guidance must reflect the scoped Execution API contract.

Author: ephraimbuddy

airflow-core/docs/security/jwt_token_authentication.rst

@@ -254,20 +254,21 @@ Token structure (Execution API)
    * - ``aud``
      - Audience (from ``[execution_api] jwt_audience``, default: ``urn:airflow.apache.org:task``).
    * - ``sub``
-     - Task instance UUID — the identity of the workload.
+     - UUID identifying the task instance, callback, processor session, or parsing attempt, depending on the scope.
    * - ``scope``
-     - Token scope: ``"execution"`` or ``"workload"``.
+     - Token scope: ``"execution"``, ``"workload"``, ``"callback"``, ``"dag_processor_session"``,
+       ``"dag_processor"``, or ``"dag_parse"``.
    * - ``iat``
      - Issued-at timestamp.
    * - ``nbf``
      - Not-before timestamp.
    * - ``exp``
-     - Expiration timestamp (``iat + [execution_api] jwt_expiration_time``).
+     - Expiration timestamp, determined by the scope's lifetime and any parent credential's expiry.
 
 Token scopes (Execution API)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-The Execution API defines two token scopes with different lifetimes:
+The Execution API uses the following token scopes. Each endpoint accepts only its declared scopes:
 
 **workload**
    A token embedded in the workload JSON payload when the Scheduler
@@ -281,12 +282,28 @@ The Execution API defines two token scopes with different lifetimes:
    backed-up queue before its workload token expires.
 
 **execution**
-   A short-lived token (default 10 minutes) accepted by all Execution API endpoints.
+   A short-lived token (default 10 minutes) accepted by endpoints that allow task or callback execution.
    This is the standard scope for worker communication during task execution. Issued
    by the server when the worker transitions to running via the ``/run`` endpoint.
    The ``JWTReissueMiddleware`` refreshes ``execution`` tokens transparently,
    so the worker maintains access for the duration of the task.
 
+**callback**
+   A single-use token exchanged at ``/callbacks/{callback_id}/run`` for an ``execution``
+   token when a queued callback starts.
+
+**dag_processor_session**
+   A provisioned credential accepted only by ``POST /jobs`` for Job registration and renewal.
+
+**dag_processor**
+   A Job credential for heartbeats, completion, Connection and Variable reads for granted bundles,
+   and parsing-token exchange.
+
+**dag_parse**
+   A credential for one parsing attempt, granting parse-time access within its signed bundle.
+
+See `Dag processor HTTP client credentials`_ for provisioning, lifetime limits, and authorization details.
+
 Tokens without a ``scope`` claim default to ``"execution"`` for backwards compatibility.
 
 Token delivery to workers

airflow-core/tests/unit/api_fastapi/execution_api/test_dag_processor_client.py

@@ -110,6 +110,14 @@ async def shutdown(self, sockets=None):
                 ("execution_api", "jwt_expiration_time"): "300",
             }
         ),
+        # Real HTTP/DB responses can exceed the one-second renewal deadline on CI.
+        # Unit tests in dag_processing/test_api_client.py cover that deadline separately.
+        mock.patch.object(
+            DagProcessorAPIClient,
+            "_get_bounded_timeout",
+            autospec=True,
+            side_effect=lambda client: client.timeout,
+        ),
         socket.socket() as listener,
     ):
         listener.bind((api_bind_host, 0))