Access Token vs. Refresh Token: A Visual Guide and Best Practices
A clear overview of what access tokens and refresh tokens are, how they work together in OAuth 2.0/OIDC, their differences, and security recommendations.
- Complexity
- Intermediate
- Reading
- 5 min read
- Published
While the image is fitted, the left and right arrows move to the previous and next infographic. Once it is zoomed in, the arrows move the image instead. The plus and minus keys zoom, and the zero key fits it again.
Loading the image…
About this infographic
The infographic explains two key credentials used in web, mobile, and API applications: the Access Token (short-term, limited scope, sent with every request) and the Refresh Token (long-term, used only to obtain new Access Tokens). It describes the typical Authorization Code Flow with OAuth 2.0/OIDC: the user logs in, the authorization server issues both tokens, the client uses the Access Token to access APIs, and when it expires, it redeems the Refresh Token for a new one. It highlights why to use both: greater security, a better user experience, stateless scalability, and the principle of least privilege. It compares aspects such as purpose, duration, exposure, storage (memory vs. secure storage such as httpOnly cookies, Keychain, or Keystore), rotation, and revocation implications. Include best practices: always use HTTPS, secure storage of the Refresh Token, rotation with each use, revocation/invalidation mechanisms, and auditing/monitoring. Indicate areas of use (web, mobile, microservices, IoT) and mention related standards (OAuth 2.0, OIDC, JWT).
Key takeaways
- Access Token: a short-lived credential with limited scope used to access APIs.
- Refresh Token: a long-lived credential used solely to renew Access Tokens.
- Combining the two improves security and the user experience while maintaining stateless sessions.
- The Access Token must be kept in memory; the Refresh Token must be stored securely (e.g., in an httpOnly cookie or the system's keychain).
- Rotating and invalidating refresh tokens helps prevent theft and misuse.
- Revoking an access token is difficult; its short expiration period reduces the risk.
- Auditing and monitoring help detect unusual usage and logouts on devices.
