The answer is here: https://developers.google.com/identity/protocols/oauth2#expiration "A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days." So the crucial thing is to get the Google project set to Production, not Testing.