Google OAuth through Vercel Connect: user_authorization_required after reported expiry

I'm testing Google Drive access through Vercel Connect in a preview deployment using @vercel/connect 2.0.2. Access works after user consent, but a later token request requires authorization again. This blocks unattended access; production is unaffected.

Configuration:

• User subject backed by Clerk, with the same subject and scopes on each request.
• Scopes: https://www.googleapis.com/auth/drive.file and https://www.googleapis.com/auth/drive.metadata.readonly.
• The configured Google authorization endpoint includes access_type=offline and prompt=consent.
• Token endpoint: https://oauth2.googleapis.com/token, using client_secret_post.
• The diagnostic calls getTokenResponse with validityBufferMs=300000 and forceRefresh=true, then checks metadata for two authorized files. It does not initiate consent.

Observed sequence:

1. User consent completes.
2. About 32 minutes later, a token request succeeds and both file metadata checks pass. Connect reports expiresAt about 15 minutes after that request.
3. About 27 minutes after the successful check, without reconnecting, the same diagnostic receives user_authorization_required. Our endpoint maps that failure to HTTP 502; no upstream vendor error is available in our diagnostic output.

Successful connector events with the same token record identifier show progressively later expiresAt values. I therefore haven't assumed that expiresAt represents Google's underlying access-token expiry, or that forceRefresh necessarily performs an upstream refresh exchange.

Could the Connect team clarify:

• What do expiresAt and forceRefresh mean for Google token renewal?
• Is offline access configured through the authorization endpoint query parameters sufficient, or is additional configuration needed?
• How can we distinguish a missing refresh grant, an upstream refresh failure, and a Connect lifecycle issue when only user_authorization_required is returned?

I have request and authorization correlation identifiers available through a private channel if a maintainer can investigate. The configuration alone does not establish whether Google issued a refresh token or whether Connect retained and used it. Vercel's support case form directed this beta-product question to the community.