title: How a mobile app will refresh access_token without refresh_token ? Implicit grant/ OAuth 2
body: <p>As said in  <a href="https://www.rfc-editor.org/rfc/rfc6749#page-10" rel="nofollow noreferrer">OAuth2 rfc6749 </a></p>
  <blockquote>
  <p>The implicit grant type is used to obtain access tokens <strong>(it does not
  support the issuance of refresh tokens)</strong> and is optimized for public
  clients known to operate a particular redirection URI.  These clients
  are typically implemented in a browser using a scripting language</p>
  </blockquote>
  <p>Refresh tokens are not suitable for implicit grant.
  My question is:</p>
  <ul>
  <li>How a mobile app, will refresh the <em>access_token</em> once it expires?</li>
  <li>How the big ones in the market are doing this? Which practices they follow?</li>
  <li>I know it is not following security recomendations, but it´s a good practice to make an long-lived <em>access_token</em> in this case? It can get annoying to need to re-authenticate each 30 min you use an app, or you close and reopen it.</li>
  <li>As necessary permissions don´t change, a silent log-in on every app start, will be a choice to consider?</li>
  </ul>