you can use refresh-token to get 'access token' at https://site.com/access-token https://site.com/access-token, and then use access token for API access. Then,

you can use refresh-token to get 'access token' at https://site.com/access-token https://site.com/access-token, and then use access token for API access. Then, having the 'just-the-right-amount-of-short-expiration-time' for access token helps... maybe? :)