Hacker News Reader

The refresh token shouldn't expire.

Maybe not for Google, but it's not part of the OAuth spec. It's perfectly valid for refresh tokens to expire.

Interesting. Many of the OAuth services I've used use non-expiring refresh tokens. Though I definitely agree; they should also have an expiry.