- Offline access tokens now have a 60‑minute TTL and include a refresh token, aligning with OAuth 2.0 spec.
- Developers must securely store refresh tokens, track expiry, and implement proactive refresh logic to obtain new tokens.
- Existing perpetual offline tokens continue to work; the change is additive.