Why should we have an access token and refresh token?
Refresh Tokens are useful because they allow applications to get new Access Tokens without forcing users to login to the system repeatedly. Typically our Access Tokens last for 20 minutes.
Are refresh tokens necessary?
So why does a web application need a refresh token? The main reason to use refresh tokens in web applications is to reduce the lifetime of an access token. When a web application obtains an access token with a lifetime of five to 10 minutes, that token will likely expire while the user is using the application.
How is a refresh token different from an access token?
Access token live for a short time span; maybe a few minutes or hours. On every HTTP request, the client sends the access token to the server. The server verifies if the user should access the requested resource based on access token validity. Refresh token live longer than access token.
Why is it important to use access token?
The server checks if the token was generated by the server and is a valid one or not. Based on the validity, server decides if the request should be authorized or not. So, to sum up, the main reason for using an access token is to enable user to access resource without sending their user name and password on each request.
What happens if my access token has expired?
If the token hasn’t expired, then the client makes API call with the valid access token. However, if the token has expired, the client should renew the access token first. So, the server receives a request to renew the access token in which the client passes both the refresh token and user’s id for verification.
What does it mean if your refresh tokens are invalid?
If you find your refresh tokens are ever responding with the error invalid grant type, it means that the user has revoked access to your app. How you handle this is up to you. If it’s a surprise to you & your user, then they simply need to go back through authentication again.