API - How to handle access- and refresh token

I am currently using a third-party API that offers "continuous access" to their API, by providing an access token and refresh token.

In order to get the access token and refresh token, I first need to generate an authorization code:

//1. Obtain an authorization_code
$grant = Http::asForm()->withToken($token)->post("https://api.tink.com/api/v1/oauth/authorization-grant", [
     'user_id' => auth()->user()->id,
     'scope' => 'accounts:read,balances:read,transactions:read,provider-consents:read'
]);

$authorizationCode = $grant['code'];

The above POST request will return an authorization code, which I will need to get the tokens:

//2. Get tokens
$params = [
            'code' => $authorizationCode,
            'client_secret'   => 'XXXXXXXX',
            'client_id'   => 'XXXXXXXX',
            'grant_type' => 'authorization_code',
 ];
$url = "https://api.tink.com/api/v1/oauth/token";
return Http::asForm()->post($url, $params)->json();

The above returns a JSON response, with:

{
    "access_token": "USER_ACCESS_TOKEN",
    "token_type": "bearer",
    "expires_in": 1800,
    "refresh_token": "REFRESH_TOKEN",
    "scope": "accounts:read,balances:read,transactions:read"
}

Now my question is: What should I do with this refresh- and access token?

I see that it expires every 30 minutes, so I can imagine that I need to generate a new authorizationCode every 30 minute for the user and get new tokens? But how to store these tokens per user - and how to automatically keep them refreshed?