Skip to content

Instantly share code, notes, and snippets.

@ashutoshkrris

ashutoshkrris/access-token-vs-refresh-token.md

Created July 29, 2026 17:08
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ashutoshkrris/8d1ec08fb070d2bdb3edafced9680b10 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ashutoshkrris/8d1ec08fb070d2bdb3edafced9680b10 to your computer and use it in GitHub Desktop.
Download ZIP
Access Token vs. Refresh Token — A concise comparison of their purpose, lifetime, usage, and storage security in OAuth 2.0 authentication.
Raw
access-token-vs-refresh-token.md
Feature Access Token Refresh Token
Primary Purpose Used to access protected APIs Used to obtain new access tokens
Lifetime Very short (15 minutes to 1 hour) Long-lived (days, months, or until revoked)
Sent Where? Sent with every API call to the Resource Server Sent only to the Authorization Server's token endpoint
Storage Security Can be kept in temporary server memory Must be stored encrypted in secure storage
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment