I am following the explicit authentication path. I am not passing no_expiry as part of the scope.

After the final POST step, I receive back an expires value of 86399 (just shy of a full day).

It seems that my options are to either take this nearly full day or never expire the tokens. Is there a middle ground? I don't want to annoy my users by requiring them to re-authenticate daily but I'm also hesitant to request non-expiring tokens.