Owner-only access tokens are valid forever, but aren't applicable for multi-user apps nor for apps which need high rate limits (T407987). What should non-owner-only apps do to avoid requiring the user to go through the authorization dialog often.

Refresh tokens are valid for 1 month by default and 1 year on Wikimedia wikis, but are invalidated when they are used. The response includes a new refresh token but in case of e.g. network error that gets lost and the app is left without a valid session. That seems annoying, especially for users on lossy networks.

Amazon handles that by providing a 60-second grace period during refresh token rotation during which the old token remains valid and can be retried. Maybe we should do something like that?