Refresh Token

A long-lived credential issued alongside an access token that allows the client to obtain new access tokens without requiring the user to re-authenticate. Refresh tokens must be stored securely, as their compromise grants persistent access. Best practices include refresh token rotation (issuing a new refresh token on each use and invalidating the old one) and binding tokens to client identity to limit their usability if stolen.