Yes, once a user login and gives you the needed permissions you can do whatever you want and whenever you want, you can create a new event in his calendar when he clicks a button, when another user clicks a button, or when no one using the app (like some backend workflows).
Yes it requires a refresh token, but Bubble will handle it with the access tokens for you, this means that using this method you will not interact with these tokens at all and Bubble will not deliver them to you, you just make your calls without including them as parameters. I asked a similar question before and got the answer from Jici here
