Refresh Token

Problem

Access tokens should expire quickly to limit damage if stolen. But if they expire every few minutes, forcing the human to log in repeatedly would be unusable.

Solution — Refresh Token

A longer-lived credential can be used to obtain new access tokens.

Refresh token
     ↓
Authorization server
     ↓
new access token

It is protected more carefully and isn't normally sent to resource APIs.

Core idea: refresh tokens allow short-lived access tokens without constant user authentication.