Xamarin app ↔ OAuth backend: Secure Storage credential validity and refresh decision

Goal: Ensure a Xamarin mobile app stores only the minimum credentials needed for API access and recovers gracefully when those credentials become invalid at the integration boundary with its OAuth‑protected backend.

Constraints: Xamarin.Essentials Secure Storage is limited to small values and relies on platform key stores (iOS Keychain, Android Keystore) that may become unreadable after a device backup/restore or key invalidation, resulting in a null or exception from GetAsync. The app must also follow least‑privilege by storing only short‑lived access tokens plus a refresh token and requesting only the required scopes, while avoiding repeated refresh‑token exchanges that could cause looping or violate provider policies.

Should the app treat a SecureStorage GetAsync failure as an immediate trigger for re‑authentication, or first attempt a silent refresh‑token exchange? How many refresh attempts are safe before falling back to full re‑authentication without risking token‑looping or exceeding provider limits?