How did the access/refresh token scheme work — was only refresh needed for renewal or both?

In the classic scheme with access and refresh tokens, only the refresh token is used to update the access token. The access token is short-lived and used to access resources, while the refresh token is long-lived and used to obtain a new access token without re-authentication.

The process typically is:

1. The client receives access and refresh tokens after a successful login.
2. When the access token expires, the client sends the refresh token to the server.
3. The server verifies the refresh token and, if valid, issues a new access token (and sometimes a new refresh token).

The access token is not needed for the refresh; only the refresh token is sufficient. This reduces risks, as the refresh token is stored more securely and used less frequently.