There is no way to tell, because ironically, the act of checking the expiry would reset the token's expiry. Access tokens, like session Id values, are extended each time a request is made and half of the remaining session time is left. For example, if the expiry time is 30 minutes, and you log in, wait 16 minutes, and make a new request, then you will again have 30 minutes before it expires. This is how users can continue to work all day as long as they are working, but are automatically logged out when they stop working. For all login flows, you must expect the possibility that a 403 Forbidden will be returned at any time, and handle the situation appropriately. Remember a user can log out early via Salesforce, or an administrator can kill the session early. You must consider this a fairly normal situation, not something to avoid.