asp.net web api - Difference between refresh_token and access_token -

i can't find reason why use refresh_token. when can make access_token longed lived...

why have both?

as have jwt tag on question assume referring json web tokens

the following referenced from

refresh tokens: when use them , how interact jwts

• access tokens carry necessary information access resource directly. in other words, when client passes access token server managing resource, server can use information contained in token decide whether client authorized or not. access tokens have expiration date , short-lived.

• refresh tokens carry information necessary new access token. in other words, whenever access token required access specific resource, client may use refresh token new access token issued authentication server. common use cases include getting new access tokens after old ones have expired, or getting access new resource first time. refresh tokens can expire rather long-lived. refresh tokens subject strict storage requirements ensure not leaked. can blacklisted authorization server.

this second reference interesting read re short-lived access token , long-lived refresh token. why oauth v2 have both access , refresh tokens?

revocation: if access token self contained, authorization can revoked not issuing new access tokens. resource not need query authorization server see if access token valid.this simplifies access token validation , makes easier scale , support multiple authorization servers. there window of time when access token valid, authorization revoked.

hope helps.