Api client should assume it's unauthorized and reauthorize on next attempt, after when the token couldn't be refreshed timely.