Authentication verifies who you are, while authorization determines what you can access.
| Feature | Access Token | Refresh Token |
|---|---|---|
| Primary Purpose | Grants permission to access specific protected resources or APIs. | Requests a brand-new access token from the authorization server. |
| Lifespan | Very short (typically 15 to 60 minutes). | Long-lived (typically days, weeks, or months). |
| Where It Is Sent | Sent to the Resource Server (API) with every request. | Sent only to the Authorization Server when refreshing. |
| Revocation | Difficult to revoke instantly because they are self-contained (JWTs). | Easily revoked or blacklisted on the server side at any time. |
| Storage Choice | Usually kept in application memory (lost on tab reload). | Kept in secure, persistent storage like HttpOnly cookies. |