Access and refresh tokens: how does client-side auth work?
The gist
An access token lives minutes to an hour and goes with every request in Authorization: Bearer. A refresh token lives days to months and is used in exactly one request — exchanging it for a new pair at the auth server. The split limits the damage of a leak: an intercepted access token expires soon, and the refresh token never travels to API servers or into logs.
The client's job is to always attach a valid access token, refresh it exactly once under any concurrency, and log out correctly when refreshing is impossible.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep