If your client session is long lived, it could outlive the life of the access token -- that is, if the access token is either manually revoked or automatically expires. BTW, totally not grokking the requirements&#x2F;goals around association.