Here's what to expect with the move to OAuth 2.0:
We recommend creating OAuth 2.0 apps for all new integrations.
No, all users will follow the same OAuth 2.0 code flow. Once you have an access token and refresh token you can refresh indefinitely or until the token is revoked by the user.
Refresh tokens expire once they’re used or after 30 days. If you don’t refresh your access token within 30 days the user will need to reauthorize your app.
If you can’t refresh your access token you’ll need to send the user through the authorization flow again to get a code that can be exchanged for a new access and refresh token.
If the callback fails for any reason you will need to send the user through the auth flow again. If the user got as far as connecting their org the first time, it will show as already connectected the second time. They can continue to click through as normal to be redirected back to your app with a new code.
At the moment, we require that your app can keep a client secret confidential. We are currently evaluating the PKCE extension to better support SPAs and mobile apps.