Seems that refresh token must been renewed manually. You may set up a cron job to notify periodically in case it expires.

I thought that the secret can be used to get a new refresh token?

As far as I know, this is not doable programmatically.

Usually with OAuth, if you use the refresh token to gain a new access token the response also contains a new refresh token and the old refresh token should be deleted. Some providers revoke/invalidate the refresh token as soon as you used it to ensure that you cannot use it again (replay attacks). For these providers you are basically forced to use the newly provided refresh token. MS doesn't seem to do that yet.

https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens

Refresh tokens have a longer lifetime than access tokens. The default lifetime for the refresh tokens is 24 hours for single page apps and 90 days for all other scenarios. Refresh tokens replace themselves with a fresh token upon every use. The Microsoft identity platform doesn't revoke old refresh tokens when used to fetch new access tokens. Securely delete the old refresh token after acquiring a new one. Refresh tokens need to be stored safely like access tokens or application credentials.

Thanks for the info. Will check this out.

State changed as code fixing the issue is committed (23ebef3d)

State changed as build OD-5855 is successful