Access & Refresh Tokens

After exchanging the code, the auth server returns:

{
  "access_token": "ya29.a0ARrdaM-...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "1//0eX...",
  "scope": "openid email"
}

Access token:

• Used for API calls: Authorization: Bearer ya29.a0ARrdaM-...
• Short-lived (typically 1 hour)
• Either opaque (server-side validated) or JWT (self-contained)

Refresh token:

• Long-lived (days, weeks, or never-expiring)
• Used to get NEW access tokens without user interaction
• Should NEVER be sent to anyone but the auth server
• Storage: backend session, NOT browser cookies

When access token expires:

POST /token
  grant_type=refresh_token
  refresh_token=1//0eX...
  client_id=YOUR_CLIENT_ID
  client_secret=YOUR_CLIENT_SECRET

Returns a new access token (and possibly a new refresh token).

Refresh token rotation: each refresh request returns a NEW refresh token; the old one is invalidated. Detects token theft — if both old and new are used, alert.

Token revocation:

• User revokes app access in account settings → both access AND refresh tokens invalidated
• Refresh tokens can be revoked individually
• Access tokens can't be revoked (but expire fast anyway)