Long-lived API token for github actions failing with 400

Having some config trouble here because the token expires too fast for our deployment script.

i’m trying to set up a github actions workflow to push config changes via the CX as Code provider, but the access token generated by the client credentials grant dies after an hour. five9 had these service accounts that just worked forever, so this rotation logic is tripping me up. the response gives me an expires_in of 3600 seconds. tried storing the refresh_token in a vault secret to swap it out, but the grant_type=refresh_token endpoint keeps throwing a 400 Bad Request. here is the error payload:

{ "error": "invalid_grant", "error_description": "refresh_token not allowed for client_credentials" }

my curl call looks like this:
curl -X POST https://api.mynice.com/oauth/token -d "grant_type=client_credentials&client_id=$ID&client_secret=$SECRET"

docs mention a long-lived token option but i can’t find where to enable it in the admin portal or the json payload. maybe i need a specific scope? checked the client settings and it’s set to “confidential”. not sure what else to tweak.