DelayKit

// after first authorizing, schedule a renewal 5 minutes before expiry
await dk.schedule("refresh-google", {
  key: account.id,
  at: new Date(tokens.expiry_date - 5 * 60 * 1000),
});

// handler refreshes, persists, reschedules.
// Google may rotate the refresh_token. fall back to the stored
// one if the refresh response omits it (common case).
dk.handle("refresh-google", async ({ key, reschedule }) => {
  const stored = await db.googleTokens.find(key);
  oauth2Client.setCredentials({ refresh_token: stored.refresh_token });

  const { credentials } = await oauth2Client.refreshAccessToken();

  await db.googleTokens.update(key, {
    access_token: credentials.access_token,
    refresh_token: credentials.refresh_token ?? stored.refresh_token,
    expiry_date: credentials.expiry_date,
  });

  reschedule({ at: new Date(credentials.expiry_date - 5 * 60 * 1000) });
});

// Slack v2 with token rotation enabled. the refresh_token is
// single-use and rotates on every call, so persist both tokens
// or the next renewal will fail.
dk.handle("refresh-slack", async ({ key, reschedule }) => {
  const stored = await db.slackTokens.find(key);

  const res = await fetch("https://slack.com/api/oauth.v2.access", {
    method: "POST",
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: stored.refresh_token,
      client_id: process.env.SLACK_CLIENT_ID!,
      client_secret: process.env.SLACK_CLIENT_SECRET!,
    }),
  });
  const data = await res.json();

  await db.slackTokens.update(key, {
    access_token: data.access_token,
    refresh_token: data.refresh_token, // mandatory rotation
  });

  // renew at 90% of the new access token's lifetime
  reschedule({ delay: `${Math.floor(data.expires_in * 0.9)}s` });
});