How does the refresh token mechanism work?

The refresh token mechanism is used for securely updating the access token without re-authenticating the user.

Workflow:

1. Upon login, the user receives two tokens: an access token (short-lived) and a refresh token (long-lived).
2. The access token is used to access protected resources.
3. When the access token expires, the client sends the refresh token to the server to obtain a new access token.
4. The server verifies the refresh token, and if it is valid, issues a new access token (and sometimes a new refresh token).
5. If the refresh token is expired or invalid, re-authentication is required.

This approach enhances security, as the access token has a short lifespan, and the refresh token is stored more securely and used only for updates.