Use refresh_token for refresh expired access token