OAuth authorization code Life Span

Short answer: No. This is what the refresh token is for. The authorization code is only valid for a short time and a single use, but with the refresh token you can get new access tokens whenever you need.


Long answer: While there is no guarantee that Twitch is doing it exactly this way, you can look at the OAuth 2 spec for what should be happening:

4.1.2.  Authorization Response
   [...]
   code
         REQUIRED.  The authorization code generated by the
         authorization server.  The authorization code MUST expire
         shortly after it is issued to mitigate the risk of leaks.  A
         maximum authorization code lifetime of 10 minutes is
         RECOMMENDED.  The client MUST NOT use the authorization code
         more than once.  If an authorization code is used more than
         once, the authorization server MUST deny the request and SHOULD
         revoke (when possible) all tokens previously issued based on
         that authorization code.  The authorization code is bound to
         the client identifier and redirection URI.

So, in a compliant implementation you can expect:

  1. The code is no longer valid after a short time, such as 10 minutes
  2. The code can only be used once, and using it a second time may lock down all tokens issued from that code

Thus, the authorization code can not be used to get more than one refresh token/access token pair. To refresh the access token you need to store and use the refresh token.