AskVibeMarked as helpful by the asker
Both are standard Google behaviour.
1. Null refresh token. Google only returns a refresh token on the first consent. Users who already granted access get none on later logins. Force it:
access_type=offline&prompt=consent
prompt=consent shows the consent screen again and returns a fresh refresh token. Store it the moment you get it; if you overwrite it with null on a later login, you lose it (check your code for that, it's common).
2. Expires after 7 days. Your OAuth consent screen is in Testing mode. In testing, refresh tokens for external users expire after 7 days. Publish the app (OAuth consent screen → Publish app). For Calendar scopes, Google will ask for verification, which takes a while, so start early.
I was literally overwriting it with null on every login. And yes, Testing mode. Two bugs, one answer, thank you lily_chen · edited
Welcome. Start the verification now, it can take weeks for Calendar scopes. amir_h · edited
The 7 days in testing mode thing got me last year too. It's in the docs but nobody finds it elif_y · edited