400 Bad Request - Missing Client ID (or client_secret) when refreshing token

(Note that app access tokens and ID tokens cannot be refreshed.)

They still expire, but it’s an app access token, you can just get a new one. Client tokens have a refresh token because otherwise you’d have to send the user through the OAuth process all over again, so refresh tokens in that situation lets you refresh the client access token without having to involve the user, a problem app access tokens do not have.