I have the following issue with the Pocket API in a Web app:
My app is written using Express on Node.js. The code is available here, the components of interest being the server entry-point and the Pocket API endpoints.
Seems the issue was indeed not re-using the user access token; I now save it in a cookie and check for that before trying to re-authorize and everything seems to work OK (see pull request).