In the past, I've simply
- deleted the copy of the connected app in the refreshed sandbox
- then gone through the web-server OAuth 2.0 flow with the customer key (and secret, if required) from production
The first part is accomplished in Lightning Experience through
Setup -> Home tab -> Apps (under the "Platform Tools" header) -> App Manager.
You click on the triangle to expand the options, and you want to select "View". If the "View" option isn't present and you only see "Manage", then that Connected App was installed in your org from another org (as opposed to being defined within your sandbox org, which is the case for the copy that appears after a refresh). You need to delete the copy from your sandbox so that you can install the "real" version from your production org.
The second part can be accomplished through Postman (it can also be done through other means, including a plain 'ol web browser). Instructions using Postman:
- Open a new tab for a request
- Go to the "Auth" tab in the request window
- Set Type to "OAuth 2.0", and Add authorization data to "Request URL"
- In the Configuration Options, use Grant Type "Authorization code"
- Callback URL, Client Id, and Client Secret are all taken from your connected app in production
- The Auth URL and Access Token URL have the same base, "https://yourdomain--sandboxname.my.salesforce.com/services/oauth2". The auth url ends with "/authorize" and the token url ends with "/token"
- Keep "Authorize using browser" unchecked
- Client Authentication should be "Send client credentials in body"
You can then push the "get new access token" button, which should cause the usual OAuth window to pop up.