some of these are already defined in `CloudAPI`. shouldn't have two different places for this. REFRESH_TOKEN is even defined in 3 different places.