Difference between Access Token and Refresh Token

Access Token

Access tokens are basically a fixed timed tokens that are only accessible for given time period by a developer.

Refresh Token

Refresh token on the other hand are used to generate a new access token as soon as the current access token is expired or invalid.

Example :-

Let’s take a scenario of a user logging into his/her account

1. User Login:

   • A user enters their credentials (username and password) on a login page.

2. Authentication:

   • The server verifies the credentials. If they are correct, the server generates an access token and a refresh token.

3. Access Token:

   • The access token is sent back to the user's device. It is used to access protected resources or APIs for a limited time (e.g., 15 minutes).

4. Refresh Token:

   • The refresh token is also sent to the user's device. It is used to request a new access token when the current one expires, without requiring the user to log in again.

5. Accessing Resources:

   • The user's device includes the access token in the headers of requests to access protected resources.

6. Token Expiry:

   • Once the access token expires, the user's device uses the refresh token to request a new access token from the server.

7. Token Renewal:

   • The server verifies the refresh token and, if valid, issues a new access token (and possibly a new refresh token).

This process ensures that the user can continue to access resources without repeatedly logging in, while maintaining security.