Looked at the refresh token part of the (final) OAuth 2 spec here: http://tools.ietf.org/html/rfc6749#section-6

There's no provision for knowing exactly when an access token expires, so it seems like maybe what we should do is make the refresh token available to clients to store on their own.  (Accessor and maybe a callback)  Allow the refresh token to be given back to rauth via the `get_session()` call, and if a protected resource request fails due to an invalid token, automatically try to refresh the token and try the request again.  (And if either the refresh request or the post-refresh request fail, then it really fails.)

It's still a big win: you don't need to manually deal with refreshing the access token, although it is not completely opaque to the API consumer.  (And I argue it's better, since there's no suitable one-size-fits-all solution here.  A Google App Engine app, for example, wouldn't be able to use sqlite to save a token.)