Ah, so this paragraph in particular
A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days.
We should probably make a note of that in the drive setup.
Which step should it go it?