(Bug?) /oauth2/token for client_credentials returns UNIX timestamp

An app access token doesn’t need a refresh token as it’s for your app, you can simply go through the same process again to get a new token. User tokens on the other hand have a refresh token because without it you would need the user to go through the authentication process again.

As for token storage, there’s no reason not to store it, just make sure however you do so is secure and that you get a new token at some point before its expiration.