Glossary
Refresh Token
A refresh token exists to solve a specific tension: access tokens are kept short-lived on purpose, so that a leaked one is only useful for a limited window, but requiring a user to log in again every time a short-lived token expires would make the short lifetime impractical. The refresh token, held more carefully and used less often, is exchanged for a fresh access token when the old one runs out.
Because a refresh token typically lives much longer than the access tokens it produces, and because possessing it lets a party keep minting new access indefinitely, its exposure is considerably more serious than a single access token's — it deserves storage and handling closer to a primary credential than to the short-lived token it generates.