diff --git a/src/wuttafarm/app.py b/src/wuttafarm/app.py
index 7d63a40..26c6ef8 100644
--- a/src/wuttafarm/app.py
+++ b/src/wuttafarm/app.py
@@ -43,7 +43,7 @@ class WuttaFarmAppHandler(base.AppHandler):
         if "farmos" not in self.handlers:
             spec = self.config.get(
                 f"{self.appname}.farmos_handler",
-                default="wuttafarm.farmos:FarmOSHandler",
+                default="wuttafarm.farmos.handler:FarmOSHandler",
             )
             factory = self.load_object(spec)
             self.handlers["farmos"] = factory(self.config)
@@ -52,7 +52,15 @@ class WuttaFarmAppHandler(base.AppHandler):
     def get_farmos_url(self, *args, **kwargs):
         """
         Get a farmOS URL.  This is a convenience wrapper around
-        :meth:`~wuttafarm.farmos.FarmOSHandler.get_farmos_url()`.
+        :meth:`~wuttafarm.farmos.handler.FarmOSHandler.get_farmos_url()`.
         """
         handler = self.get_farmos_handler()
         return handler.get_farmos_url(*args, **kwargs)
+
+    def get_farmos_client(self, *args, **kwargs):
+        """
+        Get a farmOS client.  This is a convenience wrapper around
+        :meth:`~wuttafarm.farmos.handler.FarmOSHandler.get_farmos_client()`.
+        """
+        handler = self.get_farmos_handler()
+        return handler.get_farmos_client(*args, **kwargs)
diff --git a/src/wuttafarm/auth.py b/src/wuttafarm/auth.py
index ab3f67a..1155046 100644
--- a/src/wuttafarm/auth.py
+++ b/src/wuttafarm/auth.py
@@ -25,7 +25,6 @@ Auth handler for use with farmOS
 
 from uuid import UUID
 
-from farmOS import farmOS
 from oauthlib.oauth2.rfc6749.errors import InvalidGrantError
 from sqlalchemy import orm
 
@@ -89,8 +88,7 @@ class WuttaFarmAuthHandler(AuthHandler):
         return None
 
     def get_farmos_oauth2_token(self, username, password):
-        url = self.app.get_farmos_url()
-        client = farmOS(url)
+        client = self.app.get_farmos_client()
         try:
             return client.authorize(username=username, password=password)
         except InvalidGrantError:
diff --git a/src/wuttafarm/farmos/__init__.py b/src/wuttafarm/farmos/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/src/wuttafarm/farmos.py b/src/wuttafarm/farmos/handler.py
similarity index 87%
rename from src/wuttafarm/farmos.py
rename to src/wuttafarm/farmos/handler.py
index 16ec1a6..78e76b6 100644
--- a/src/wuttafarm/farmos.py
+++ b/src/wuttafarm/farmos/handler.py
@@ -23,6 +23,8 @@
 farmOS integration handler
 """
 
+from farmOS import farmOS
+
 from wuttjamaican.app import GenericHandler
 
 
@@ -32,6 +34,14 @@ class FarmOSHandler(GenericHandler):
     :term:`handler`.
     """
 
+    def get_farmos_client(self, hostname=None, **kwargs):
+        """
+        Returns a new farmOS API client.
+        """
+        if not hostname:
+            hostname = self.get_farmos_url()
+        return farmOS(hostname, **kwargs)
+
     def get_farmos_url(self, path=None, require=True):
         """
         Returns the base URL for farmOS, or one with ``path`` appended.
diff --git a/src/wuttafarm/web/views/farmos/animals.py b/src/wuttafarm/web/views/farmos/animals.py
index ab5167c..aa00412 100644
--- a/src/wuttafarm/web/views/farmos/animals.py
+++ b/src/wuttafarm/web/views/farmos/animals.py
@@ -27,8 +27,6 @@ import datetime
 
 import colander
 
-from farmOS import farmOS
-
 from wuttafarm.web.views.farmos import FarmOSMasterView
 from wuttafarm.web.forms.widgets import AnimalImage
 
diff --git a/src/wuttafarm/web/views/farmos/master.py b/src/wuttafarm/web/views/farmos/master.py
index 40f7bfc..d653418 100644
--- a/src/wuttafarm/web/views/farmos/master.py
+++ b/src/wuttafarm/web/views/farmos/master.py
@@ -23,8 +23,6 @@
 Base class for farmOS master views
 """
 
-from farmOS import farmOS
-
 from wuttaweb.views import MasterView
 
 
@@ -54,8 +52,16 @@ class FarmOSMasterView(MasterView):
         if not token:
             raise self.forbidden()
 
-        url = self.app.get_farmos_url()
-        return farmOS(url, token=token)
+        def token_updater(token):
+            self.request.session["farmos.oauth2.token"] = token
+
+        # nb. must give a *copy* of the token to farmOS client, since
+        # it will mutate it in-place and we don't want that to happen
+        # for our original copy in the user session.  (otherwise the
+        # auto-refresh will not work correctly for subsequent calls.)
+        token = dict(token)
+
+        return self.app.get_farmos_client(token=token, token_updater=token_updater)
 
     def get_template_context(self, context):