What is the difference between an access token and a refresh token?

Access token and refresh token are two different types of tokens used for authentication and authorization in systems with an OAuth-like scheme.

• Access token is a short-lived token that grants the client access to protected resources. It usually has a short expiration time (for example, a few minutes or hours). It is used for direct API access.

• Refresh token is a long-lived token used to obtain a new access token after the current one expires. It is typically stored more securely and not transmitted frequently.

Example scenario:

1. The client receives an access token and a refresh token after successful authentication.
2. The client uses the access token to make API requests.
3. When the access token expires, the client sends the refresh token to the authorization server to get a new access token.
4. If the refresh token is also expired or revoked, re-authentication of the user is required.

Thus, the refresh token enhances security and convenience by allowing the user to avoid frequent login and password requests.