Hi Paul! Pasting the process flow along with answer for future reference:

Process Flow

1. 3rd party software/service makes a call to SERP REST API
2. SERP requests authentication (Standard ID + password) which appears as a login screen
3. SERP sends other software an access token and refresh token
4. 3rd party requests data from SERP, sending the access token with the request
5. after a few minutes, the access token expires and cannot be used again
6. without a refresh token, someone would need to enter the standard ID and password each time a connection is made. the refresh token prevents this and allows a new access token to be sent by SERP to the other software


Refresh Token Export:

When does Refresh Token Expire?
There is no expiry.

If we did set an expiry, it would mean that the user has to login with username and password every time they want to talk to our system which would not work well with full integration situations


Best Regards,
Omar