Access Token vs Refresh Token

Definition

A dual-token authentication architecture designed to maximize security while maintaining a seamless user experience.

Explain Like I'm New

JWTs cannot be easily revoked. If a hacker steals your JWT, they own your account until the token expires. To fix this, we use TWO tokens. 1. The Access Token: Lives for only 15 minutes. It is used for all API requests. If stolen, the hacker only has 15 minutes. 2. The Refresh Token: Lives for 30 days, saved securely in an `httpOnly` cookie. It can only do ONE thing: ask the server for a new 15-minute Access Token.

Real World Example

You log into Spotify. You never have to log in again. Spotify gives you a 15-minute access token and a 30-day refresh token. Every 15 minutes in the background, the app silently uses the refresh token to get a new access token without interrupting your music.

Common Use Cases

•High-security enterprise apps
•Seamless mobile app logins

Terminal Output

bash / terminal

// --- THE FLOW --- console.log("1. User logs in."); console.log("2. Server issues Access Token (15m) and Refresh Token (30d)."); console.log("3. User clicks 'View Dashboard'. Client attaches Access Token to header."); console.log("4. Server verifies Access Token. Grants access.\n"); console.log("--- 16 MINUTES LATER ---"); console.log("5. User clicks 'View Profile'. Client sends Access Token."); console.log("6. Server rejects! '401 Unauthorized - Token Expired'."); console.log("7. Client silently catches the 401. Sends the Refresh Token to the /refresh-token endpoint."); console.log("8. Server verifies Refresh Token against the database."); console.log("9. Server issues a brand new 15-minute Access Token."); console.log("10. Client retries the 'View Profile' request with the new token. Success!");

Interview Questions

basic

Why not just make the Access Token last for 30 days?

intermediate

Where is the safest place to store a Refresh Token in a web browser?

advanced

What is Refresh Token Rotation?

Flash Cards

Question

Why not make Access Token last 30 days?

Click to reveal answer

Answer

Security. Because Access Tokens are stateless and cannot easily be revoked, if someone steals it (via XSS), they have full access to the user's account for 30 days.

Question

Safest place to store it?

Click to reveal answer

Answer

An `httpOnly` cookie. This prevents any JavaScript (and therefore any XSS hackers) from ever reading the token. `localStorage` is highly vulnerable to XSS attacks.

Question

What is Rotation?

Click to reveal answer

Answer

A security feature where every time the Refresh Token is used to get a new Access Token, the server ALSO issues a brand new Refresh Token and invalidates the old one. If a hacker steals a refresh token and uses it, the user's token becomes invalid, alerting the system to a breach.