For example, the API: https://developers.google.com/apis-explorer/#p/calendar/v3/calendar.calendarList.list?_h=4& need to use OAuth 2.0 to authorize before making the call.
But what if I want to set up a cron job in the server and fetch the API periodically? Can I assume the access token remain unchanged all the time? (Unless I revoke it manually)
The access token has a limited lifetime. When it expires, you can programatically get a new access token by using the refresh token. Practically what that means, is that once access is authorized, it will work without user input until access is revoked.