How is the Access Token changed or updated when using or refreshing the Refresh Token?

Access Token is a short-lived token used for user authentication when making requests to the API. Refresh Token is a longer-lived token that allows obtaining a new Access Token without re-entering credentials.

When the Access Token expires, the client sends the Refresh Token to the authorization server. The server verifies the validity of the Refresh Token and, if valid, issues a new Access Token (and sometimes a new Refresh Token). Thus, the Access Token is refreshed by making a request using the Refresh Token, which helps maintain the user session without re-login.

Example in Python (simplified):

import requests

def refresh_access_token(refresh_token):
    response = requests.post('https://auth.example.com/token', data={
        'grant_type': 'refresh_token',
        'refresh_token': refresh_token,
        'client_id': 'your_client_id',
        'client_secret': 'your_client_secret'
    })
    if response.status_code == 200:
        tokens = response.json()
        return tokens['access_token'], tokens.get('refresh_token', refresh_token)
    else:
        raise Exception('Failed to refresh token')

# Usage:
new_access_token, new_refresh_token = refresh_access_token(old_refresh_token)