Authorization code flow mode (Embedded widget app) - whether the token refreshes for every Ring central API call or will it refresh only after its expiry in 7 days.

Inorder to enable the same in the Embedded widget app. Is it enough to include the secretkey in env.default file or only in the Iframe render script. Please clarify