In general, for oauth to work, the user needs to authorise salesforce to perform requests on their behalf.
If you haven't done it already, I suggest you go through the documentation on the many different types of oauth flows, and see if one of them fits your scenario.
One of the common misconception is that connected app is required for every org.
Connected app can be created in a developer environment and that's sufficient for the other orgs to authorize their Salesforce environment and you can store the necessary tokens.
Workbench , Salesforce CLI and lot of third party apps use same method. They have a org where they ...
You're creating a token that expires in 5 seconds from 'now' and by the time it arrives at the destination, it has expired, thus the error message.
When you call setValidityLength(...), you're setting the value of the exp (expiration) claim. The format of expiration claim is number of seconds elapsed since epoch. From RFC 7519
4.1.4. "exp" (Expiration ...