Access tokens and refresh tokens

OAuth 2.0 Course · lesson 7 of 13 · 4 min read

Short-lived access, long-lived refresh - and why that split exists.

Open this lesson in the learning hub

Key points

  • An access token is short-lived, often 5-60 minutes, and is sent on every API call.
  • Because it is used constantly it is the most likely to leak - so it must expire quickly.
  • A refresh token lives much longer but is sent only to the auth server, rarely.
  • When the access token expires, the client silently exchanges the refresh token for a new one.
  • Refresh token rotation issues a new refresh token each time; reuse of an old one signals theft and revokes the chain.

Short access tokens limit the damage of a leak; refresh tokens keep the user logged in anyway.

Scopes and consent The mistakes that cause breaches

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.