What is the difference between an access token and a refresh token?

An access token is a short‑lived credential that a client presents to a resource server to prove that it has been authorized to perform a specific action. It usually contains scopes, an expiration time, and is signed by the authorization server. Because it is valid for a limited period (often minutes to a few hours), it limits the window of opportunity for an attacker if the token is compromised. A refresh token, on the other hand, is a long‑lived credential that is used to obtain a new access token once the current one expires. It is typically stored more securely (e.g., in an HTTP‑only cookie or secure storage) and is never sent to the resource server. The refresh token allows the client to maintain a user session without requiring the user to re‑authenticate. In OAuth 2.0, the flow is: the client exchanges user credentials for an access token and a refresh token; the client uses the access token to call APIs; when the access token expires, the client sends the refresh token to the token endpoint to receive a fresh access token. This separation of concerns improves security and user experience.