Once you have the new access token you go back to the authorization lock and replace the access token? I was thinking the long lasting authorization token gave us direct access without having to do the redundant step of asking for a temporary one.

Maybe we will just use basic auth for swagger then and a long lasting token for the actual app.

Edit: Ok I confirmed it works, but easier to stick with basic auth while testing in swagger so we don't have to jump between 2 systems and generate a new password every time. Then use the long lasting key in the final app. Thanks for the explanation.