Quiz Entry - updated: 2026.10.22
How do access tokens and refresh tokens differ in OAuth?
The access token is presented to the resource server and is short-lived (minutes to hours); the refresh token is presented only to the authorization server, lives longer (days to years), can be revoked, and gets new access tokens without the user logging in again.
| Access token | Refresh token | |
|---|---|---|
| Used at | Resource server (the API) | Authorization server (token endpoint) only |
| Lifetime | Short: minutes or hours | Long: days, months, years |
| Purpose | Grants access to the resource | Obtains new access tokens |
| User interaction to renew | Not applicable | None: the user does not authenticate again |
| Revocation | Usually just expires | Can be revoked explicitly |
| Issued | After a successful grant | Usually together with the access token (optional) |
The split is a security trade-off. The access token is sent to APIs constantly, so it is the token most likely to leak; keeping it short-lived limits the damage. The refresh token travels much less (only to the authorization server, over a back channel), so it can live longer, and because the authorization server checks it on every use, revoking it ends the app's access for good.
Go deeper:
oauth.net: What is a Refresh Token — why refresh tokens exist and how they relate to access tokens.- RFC 6749, Section 1.5: Refresh Token — the specification's description, with a flow diagram of a refresh.