diff --git a/google/auth/_helpers.py b/google/auth/_helpers.py
index c70fd6a6b..1b08ab87f 100644
--- a/google/auth/_helpers.py
+++ b/google/auth/_helpers.py
@@ -23,7 +23,11 @@
 from six.moves import urllib
 
 
-REFRESH_THRESHOLD = datetime.timedelta(seconds=300)
+# Token server doesn't provide a new a token when doing refresh unless the
+# token is expiring within 30 seconds, so refresh threshold should not be
+# more than 30 seconds. Otherwise auth lib will send tons of refresh requests
+# until 30 seconds before the expiration, and cause a spike of CPU usage.
+REFRESH_THRESHOLD = datetime.timedelta(seconds=20)
 
 
 def copy_docstring(source_class):