Comment by jallmann

> OAuth with refresh tokens.

Then the LLM slurps up your refresh token. What's next?