How does the OAUTH refresh token get invalidated?

[EMeinfelder]

I'm not clear on the cases in which the OUATH refresh token can become invalid? I believe there is an API method to delete tokens, but I'm curious about other cases? I'm especially curious about the 2 following cases.

• Do they expire after a time limit?
• If the list of scopes are changes on HubSpot, do existing tokens get invalidated or they hold the old permissions or have new permissions dictated by the scopes?

Thank you,

Edmond

[dennisedson]

@EMeinfelder 

1.  yep they expire.  There should be a expires_in parameter that you can reference.  Docs

2.  Permissions will be changed when reinstalling the app.  The portal user will need to authorize the new scopes before they can be used