We were encountering an issue with users getting error messages after they've refreshed their access token. Our access tokens are valid for 12 hours. Trying to use datumctl after the access token expired resulted in my token being refreshed but subsequent commands failing with an invalid refresh token error.

$ datumctl activity query --organization datum --limit 10                                               
TIMESTAMP             VERB   USER                    NAMESPACE   RESOURCE        NAME    STATUS
2026-01-17 11:19:18   get    auth-provider-openfga               organizations   datum   200
...

$ datumctl activity query --organization datum --limit 10
error: query failed: Post "https://api.datum.net/apis/resourcemanager.miloapis.com/v1alpha1/organizations/datum/control-plane/apis/activity.miloapis.com/v1alpha1/auditlogqueries": oauth2: "invalid_request" "Errors.OIDCSession.RefreshTokenInvalid"

I was able to trace this down to the new access token and refresh token not being persisted in the keyring after a refresh occurred. This was resulting in an invalid refresh token error because the previous refresh token that existed in the keychain was revoked after a new token was issued.

I fixed this by introducing a new TokenSource that automatically refreshes tokens and persists the updated tokens back into the keychain.

Other changes:

• I adjusted the error messaging so the user will be given a friendly error message if the refresh token is not valid and they need to re-authenticate.
• I modified the get-token command to use the new token source