Backend & systems·Security and identity
you keep access tokens short-lived and hand over a longer-lived credential to get a new one when they expire.
Refresh token
A long-lived credential exchanged for new short-lived access tokens. It is what makes short expiry practical without asking the user to log in every fifteen minutes. Because it is long-lived it is the higher-value secret: store it server-side or in an httpOnly cookie, and rotate it on every use so theft is detectable.