diff --git a/.gitignore b/.gitignore
index f46c1ec..ad32f8f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -81,6 +81,7 @@ celerybeat-schedule
 # virtualenv
 venv/
 ENV/
+.venv
 
 # Spyder project settings
 .spyderproject
@@ -95,3 +96,12 @@ ENV/
 # Singer files
 *.config.json
 *.catalog.json
+
+# IDE
+.idea
+
+# Singer config
+config.json
+tap-*.json
+target-*.json
+*config.json
diff --git a/setup.py b/setup.py
index fe87efc..049f443 100644
--- a/setup.py
+++ b/setup.py
@@ -4,7 +4,7 @@
 
 setup(
     name='tap-bing-ads',
-    version="2.2.1",
+    version="2.3.0",
     description='Singer.io tap for extracting data from the Bing Ads API',
     author='Stitch',
     url='http://singer.io',
diff --git a/tap_bing_ads/__init__.py b/tap_bing_ads/__init__.py
index f898192..3a01778 100644
--- a/tap_bing_ads/__init__.py
+++ b/tap_bing_ads/__init__.py
@@ -38,6 +38,7 @@
     "oauth_client_secret",
     "refresh_token",
     "developer_token",
+    "refresh_token_ssm_param"
 ]
 
 # objects that are at the root level, with selectable fields in the Stitch UI
@@ -164,7 +165,8 @@ def get_authentication():
         authentication = OAuthWebAuthCodeGrant(
             CONFIG['oauth_client_id'],
             CONFIG['oauth_client_secret'],
-            '') ## redirect URL not needed for refresh token
+            '', ## redirect URL not needed for refresh token
+            token_refreshed_callback=save_refresh_token_to_ssm)
         # Retrieves OAuth access and refresh tokens from the Microsoft Account authorization service.
         authentication.request_oauth_tokens_by_refresh_token(CONFIG['refresh_token'])
         return authentication
@@ -172,12 +174,27 @@ def get_authentication():
         authentication = OAuthWebAuthCodeGrant(
             CONFIG['oauth_client_id'],
             CONFIG['oauth_client_secret'],
-            '',
-            oauth_scope='bingads.manage') ## redirect URL not needed for refresh token
+            '',## redirect URL not needed for refresh token
+            oauth_scope='bingads.manage',
+            token_refreshed_callback=save_refresh_token_to_ssm)
         # Retrieves OAuth access and refresh tokens from the Microsoft Account authorization service.
         authentication.request_oauth_tokens_by_refresh_token(CONFIG['refresh_token'])
         return authentication
 
+
+def save_refresh_token_to_ssm(oauth_tokens):
+    try:
+        import boto3
+        LOGGER.info(f"saving refresh token to SSM now at: {CONFIG['refresh_token_ssm_param']}")
+
+        ssm = boto3.client("ssm")
+        put_param_output: dict = ssm.put_parameter(Name=CONFIG['refresh_token_ssm_param'], Value=oauth_tokens.refresh_token, Overwrite=True)
+
+        LOGGER.info(f"put_param_output: {str(put_param_output)}")
+    except ImportError as e:
+        LOGGER.warning("SSM param not saved to SSM due to error starting boto3.  Eventually, your refresh token will expire.")
+
+
 @bing_ads_error_handling
 def create_sdk_client(service, account_id):
     # Creates SOAP client with OAuth refresh credentials for services