Access Token and Refresh Token

Access tokens and refresh tokens are both used in authentication systems, particularly in OAuth 2.0, to securely grant access to resources without exposing the user's credentials (like username and password).

1. Access Token:

   • Purpose: An access token is a credential used by an application to access an API or a protected resource on behalf of a user.

   • Usage: It is usually a string that represents the authorization granted to the application by the resource owner (user).

   • Lifetime: Access tokens have a limited lifetime. They are issued with an expiration period after which they become invalid. This helps in enhancing security by limiting the exposure if a token is compromised.

   • Scope: Access tokens often include information about the permissions granted (scope) to the application, specifying what actions the application can perform on behalf of the user.

   • Example: When you log into a service using your Google or Facebook account on a third-party website, the access token allows that website to access certain information from your Google or Facebook account.

2. Refresh Token:

   • Purpose: A refresh token is used to obtain a new access token when the current access token becomes invalid or expires.

   • Usage: Refresh tokens are typically longer-lived than access tokens and are used to request new access tokens without requiring the user to re-authenticate.

   • Security: Refresh tokens are more secure than storing user credentials because they can be revoked if compromised. They can also have a different expiration period and can be used to obtain a new access token without user interaction.

   • Example: After the initial authentication, the refresh token is used behind the scenes to get a new access token when the current one expires, so the user doesn't need to log in again.

In summary, Access token get expired soon compare to refresh token. When access token expired, it ask the server for refresh token and re-login the user without password.

Below is the video reference in Hindi by Hitesh Choudhary