diff --git a/plugin/auth/oauth_test.go b/plugin/auth/oauth_test.go
new file mode 100644
index 000000000..1660fa708
--- /dev/null
+++ b/plugin/auth/oauth_test.go
@@ -0,0 +1,35 @@
+package auth
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+func TestOAuth(t *testing.T) {
+	var storerCalled int
+	storer := func(t *oauth2.Token) any {
+		storerCalled++
+		return t
+	}
+
+	ts, err := NewOauth(context.TODO(), "foo", "bar", &oauth2.Config{
+		ClientID: "baz",
+	}, WithTokenStorerOption(storer))
+	require.NoError(t, err)
+
+	token, err := ts.Token()
+	require.ErrorContains(t, err, "missing token credentials")
+	require.False(t, token.Valid())
+	require.Equal(t, 0, storerCalled)
+
+	ts.updateToken(&oauth2.Token{AccessToken: "at"})
+	require.Equal(t, 1, storerCalled)
+
+	token, err = ts.Token()
+	require.NoError(t, err)
+	require.True(t, token.Valid())
+	require.Equal(t, 1, storerCalled)
+}