500 on Approving Request Access to Shared link with invite only option

REL_IT Dropbox refresh tokens don't expire automatically, so you should store and re-use them. If you didn't store your refresh token, you'll need to process the authorization flow again to get another one.

For reference, Dropbox is no longer offering the option for creating new long-lived access tokens. Dropbox is now issuing short-lived access tokens (and optional refresh tokens) instead of long-lived access tokens. You can find more information on this migration here. Apps can still get long-term access by requesting "offline" access though, in which case the app receives a "refresh token" that can be used to retrieve new short-lived access tokens as needed, without further manual user intervention. Refresh tokens do not expire automatically and can be used repeatedly. You can find more information in the OAuth Guide and authorization documentation. There's a basic outline of processing this flow in this blog post which may serve as a useful example.

You can revoke shared links via the API by using the /2/sharing/revoke_shared_link endpoint. That requires one API call per shared link though, so you'd need to make multiple calls to revoke multiple links.