If the access token is issued successfully but isn’t being refreshed, the first thing I’d check is whether Salesforce is actually returning a refresh token during the initial OAuth flow. If the refresh token isn’t issued or stored, automatic token renewal won’t work.
A few things to verify:
Ensure your Connected App includes the refresh_token (or offline_access, depending on the flow) scope.
Confirm the Connected App’s OAuth policies allow refresh tokens and that they haven’t expired or been revoked.
Check that the token response from Salesforce contains a refresh_token, not just an access_token.
Review the provider configuration to ensure the correct token endpoint is configured for refresh requests and that the client credentials are valid.
Enable request/response logging (without exposing secrets) to verify whether a refresh request is being sent when the access token expires or if the application is attempting to reuse the expired token.
We’ve seen similar issues where the root cause was missing OAuth scopes, Connected App policy settings, or the refresh token not being persisted after the initial authorization. Salesforce Consulting Services can also be a useful resource for OAuth implementation, authentication architecture, and Salesforce integration best practices.
One question: when the token expires, do you see any request being made to the Salesforce token endpoint, or does the application continue trying to use the expired access token? That can help narrow down whether the issue is configuration-related or within the authentication flow itself.