#aaronpkwe've never specified anything different about token expiration/refresh in IndieAuth compared to OAuth 2.0. Most IndieAuth apps and servers don't use refresh tokens, but there's nothing stopping them from doing it the way OAuth 2.0 specifies.