In my Jolla account, if I select the 'Oauth2 applications' I see three apps:
join.jolla.com and two others listed with a long hex string name.
Are those the keys to access the store or what else? (and I may have two as I factory-reset my device once).
What about happens when the expiration time (which seems to be in Unix-epoch format, and set two weeks after last renewal) is over?

If the expiration time is over, a new key will be issued automatically.
The device should be smart enough to request a renewal.