In what period does the firebase's app token changes and how to manage it?

The token is generated, after the app is first launched, as soon as the phone can connect to the Google servers. Due to the required connectivity this might not happen immediately, but in most of the cases it will happen in few seconds after the user open the app. As soon as the token is generated the method onTokenRefresh() is called.

As you pointed out the token can change, in which case the onTokenRefresh() method will be called again.
The refresh event is somehow rare, don't expect to see it often at all.

When the refresh token happens, all the messages that have been "successfully" sent (the API returned you a message-id) to the old token will be delivered.

Finally, even after the refresh happened the old token will still be working for a short period, to allow the app to communicate the new token to its back-end.

On initial startup of your app, the sdk of FCM generates the registration token for the client app instance. As above said, It is a rare event. To be specific,The registration token may change when:

• The app deletes Instance ID.
• The app is restored on a new device
• The user uninstall/reinstall the app
• The user clears app data.

Instance ID provides a unique ID per instance of your apps.Instance ID provides a simple API to generate security tokens that authorize third parties to access your app's server side managed resources.The Instance ID server can even tell you when the device on which your app is installed was last used.We can use this to decide whether to keep data from the app or send a push message to re-engage with the users.

Every time the device token is changed, It is reflected in onTokenRefresh() method.For getting the device token when it is changed, we can call this method to get the refreshed token.

and to get the device token at any time we can use FirebaseInstanceId.getInstance().getToken() method to get the current device token.It takes a bit of time to get the device token.

Click here to read more about accessing device registration token.