Refresh Tokens

Summary

A longer-lived token used to silently obtain a new short-lived access token, keeping users logged in without forcing frequent re-authentication or leaving long-lived tokens exposed.

• 1Implement a refresh-token endpoint that issues a new access token.
• 2Learn why access tokens are kept short-lived and refresh tokens longer-lived.
• 3Implement refresh token rotation to limit damage if one is stolen.