When I was dealing with a similar problem, I found creating a new OAuth client ended up being the best solution. This allowed me to generate a new refresh_token for the account based on the Google Analytics scope. Once I created the new client, I downloaded the client_secrets.json and ran through the entire process, step by step, following the Complete Example by Google. After that, I was able to refresh the token without any problems. It might be worth a shot for you too!