QuickBooks OAuth 2.0 Refresh Patterns That Survive Production

OAuth 2.0 with QuickBooks Online looks deceptively simple in development and reliably breaks in production around day 100 when refresh tokens themselves expire.

This post walks through the four states every integration must handle: valid access token, expired access token with valid refresh token, expired refresh token (re-consent required), and revoked authorization. We cover token storage, atomic refresh-with-lock to prevent thundering herds, and how to surface re-consent prompts to end users gracefully.