Refresh Tokens & Scopes

Imagine using an app that needs to access your online photos. It gets permission, but what if that permission expires after just an hour?

You'd have to log in again and grant permission every single time! That's not a great user experience, is it?

Access tokens are like temporary keys. They grant access to specific resources (like your photos) for a short time, often minutes or hours.

This short lifespan is a crucial security feature. If an access token is stolen, an attacker has a limited window to use it, reducing potential damage.