Answer
Access tokens are short-lived and used for API calls. Refresh tokens generate new access tokens without re-login.
Quick Answer
Access tokens are short-lived (15 minutes) and used to authenticate API requests. Refresh tokens are long-lived (days/weeks) and used only to get new access tokens when the old ones expire. This way, if an access token leaks, it expires quickly. Refresh tokens are stored more securely (httpOnly cookie) and can be revoked on the server.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ