Access tokens are generally short-lived credentials used to access APIs. Refresh tokens are longer-lived credentials used to obtain new access tokens.

Short access-token lifetimes reduce the impact of token theft. Refresh tokens require stronger protection and often use rotation and reuse detection.

A secure token architecture defines expiration, audience, issuer, scopes, revocation strategy, rotation behavior, and storage.