This request is responded to with either an error (HTTP status code 400) or an access token of the form access_token=...&expires=1234. expires will only be set if scope does not include no_expiry, the use of which is strongly advised against unless your app truly needs perpetual access.
Source
How do I handle token expiration in my application?
This may be more of a general OAuth2 / authentication question than one specific to the Stack Exchange API / Stack Apps. But in those cases, I store the expiration timestamp along with the token (though the token is usually stored with some extra security) - where exactly depends on the platform I'm developing for. After the expiration timestamp, I simply present the authentication dialog again. Depending on your user's browser and/or settings, the login may be automatic and little to not blocking the UI.
