액세스 토큰, 새로 고침 토큰 및 범위

After a successful flow, OAuth2 hands the client a token instead of the user's credentials. The client presents this token to the resource server to access protected data.

An access token is a short-lived credential proving the client may call an API on the user's behalf. It is sent on each request, usually in the Authorization header.

Access tokens are deliberately short-lived (minutes to an hour). If one leaks, the window of misuse is small. But forcing the user to re-login constantly would be painful.

A refresh token is a longer-lived credential the client uses to obtain new access tokens without bothering the user. It is stored securely and never sent to APIs.

When the access token expires, the client posts the refresh token to the token endpoint and receives a fresh access token.

Scopes declare exactly what a token may do, such as read:profile or write:orders. They implement least privilege at the token level.

The client requests scopes during authorization. The user consents, and the issued token is limited to the granted scopes, no more.

The resource server checks that the token carries the scope an endpoint requires. A token with only read:profile is rejected from a write endpoint.

An access token may be a random reference the server looks up, or a self-contained JWT carrying claims the server validates by signature without a lookup.

Refresh tokens can be revoked to end a session, for example on logout or suspected compromise. This invalidates the ability to mint new access tokens.

Store tokens carefully: never in plain localStorage for sensitive apps, keep refresh tokens server-side or in secure storage, and always use HTTPS in transit.

You learned how OAuth2 tokens work:

• Access tokens are short-lived and sent to APIs
• Refresh tokens silently obtain new access tokens
• Scopes enforce least privilege per token
• Tokens can be reference-based or JWTs
• Revocation and secure storage protect sessions

These concepts underpin every OAuth2 grant type you will study next.