I reckon, what you are currently trying is "Username password oAuth flow" and it doesn't provide a refresh token.
There are 3 ways to authenticate user with Salesforce (Commonly used)
- Username password oAuth authentication flow
This is a very basic flow and needs user to pass their credentials with the request each time. It doesn't provide the refresh token in the response, therefore you will need to request a new access token. However you can control this token expiry time upto 12 hours using session settings.
- oAuth 2.0 User agent flow
This flow is bit more secure than previous approach and doesn't need user credentials in the request. It also provides the refresh token, so you can get a new access token every time it is expired.
Additionally, this step needs user to manually authenticate and authorise Salesforce to talk to your application and will be a one time activity at the start of the application.
Only problem is that tokens are shared in the URL, instead of the response body.
- oAuth 2.0 Web server auth flow
Most common flow for authorising applications to access data in a secure manner and is being supported by most of the latest API's.
It would meet most of your requirements.