A Salesforce instance is configured so that users can log in using OpenID Connect and their Google credentials.
I am trying to access the token provisioned by the login via google to make callouts to the Google APIs that I can request access to by using the Auth Providers scope parameter.
The getAccessToken method in Auth.AuthToken class is documented as being able to
Returns an access token for the current user using the specified 18-character identifier of an Auth. Provider definition in your organization and the name of the provider, such as Salesforce or Facebook.
I find that the token returned by this method can be used successfully by a user for a certain amount of time after login (I haven't timed it yet), but eventually it ceases to work, and the Google callouts fail with a 401 Unauthorised response. Refreshing the Visualforce page with a controller that calls this class does not resolve the issue, only logging out and back in resolves it.
Google documentation at https://developers.google.com/accounts/docs/OAuth2Login#refresh-tokens suggests that
access_type=offline needs to be specified in the initial login to request a refresh token that can be used to gain another access token once the first one expires.
There is no way to configure this parameter within the Salesforce UI (we can only change the scope of the token requested), and even if it could be there is no method to force a refresh.
Google's documentation states the the lifetime of the access token is returned when an access code is validated https://developers.google.com/accounts/docs/OAuth2Login#exchangecode, so salesforce could detect when the token expires and refresh it, and also it would be useful to provide an apex method to allow a developer to force a refresh.
Is the Auth.AuthToken class designed only to be used in the moments after login? Should I expect salesforce to refresh this token for me?