Until External API activity adds built-in support for OAuth token retrieval, the marketer (or consultant helping the customer) will need to refresh the OAuth token every 24 hours (or other expiry times) and configure those in the workflow activity Execution tab where one can specify any custom Headers to be sent on the API call.