In the docs on user auth, it says
This request is responded to with either an error (HTTP status code 400) or an access token of the form
expireswill only be set if scope does not include
no_expiry, the use of which is strongly advised against unless your app truly needs perpetual access.
With expiration turned off you could request write access once and then keep it for later uses, instead of asking every time it expires. It would make applications much simpler, and the user could revoke permissions anytime.
So why do the docs say that
no_expiry shouldn't be used unless required?