Maybe Gmail, but definitely not GCP. I have to re-auth every day or two for that.

And even with Gmail there's a decent chance it isn't just "blindly trust unlimited-duration token". Cookie stealing is now one of the main forms of credential compromise, so I bet there's some form of browser and/or IP verification going on to demand a reauth when some `curl` instance from a Russian VM tries to make use of it...