Keap's OAuth implementation issues access tokens with a 1-hour TTL. We previously refreshed on 401 failure; we now refresh proactively if the cached token is within 5 minutes of expiry.
Net effect: zero failed Keap action calls due to token expiry across last week's traffic, down from 0.3% before.
