Julian, thanks for this summary and for the investigation which hopefully may lead to future improvements in this workflow. One question before I dive into your suggested approach (which will likely take a bit of time). I had gotten the service processes to work with the approach I documented above -- use interactive login to grab a token which saves into oidctoken.dat. This approach worked multiple times, but it would often need to re-interactive login after only one or two runs instead of successfully refreshing. My assumption had been the refreshtoken approach should allow it to indefinitely refresh without interactive (and in fact on my local PC it more or less does). Is this your expectation as well and I’m facing an unexpected/bug/issue here with my service token “failing” frequently?