OAuth refresh token

An OAuth refresh token is the long-lived credential an app receives when you grant it access to your account on another service. OAuth deliberately splits credentials in two: short-lived access tokens, which authorize actual API calls and expire quickly (often within an hour), and the refresh token, which the app stores and redeems for new access tokens whenever the old one lapses. You consent once; the app keeps working for months without ever seeing your password or asking again.

The design limits blast radius. If an access token leaks, it is useless within the hour. The refresh token is more sensitive - it represents standing access - which is why it is stored server-side, never exposed to browsers, and scoped: it can only mint access tokens with the permissions you originally granted, nothing broader.

Control stays with the account owner. Revoking the app's access from your Google or Microsoft account settings invalidates the refresh token immediately, and the next attempted refresh simply fails. For any service that writes to your account on a schedule rather than while you watch, a refresh token is the machinery that makes "connect once, works from then on" possible.

SheetLink Forms' spreadsheet connections run on this machinery. The one-click Google connection grants tokens scoped to drive.file - only sheets you pick or the product creates - and the Microsoft 365 connection works the same way for your Excel table. When the asynchronous delivery worker writes a row, it uses a current access token, refreshing behind the scenes as needed. If a refresh hiccups, the write fails visibly instead of silently: delivery retries at 5 minutes, 30 minutes, and 2 hours, with each attempt shown in the delivery log.

The scope and token posture are described on the security page, and connecting a destination is shown on how it works.