What is a Refresh Token?

OAuth access tokens are deliberately short-lived (often minutes to a couple of hours) to limit the damage if one is ever leaked. But requiring a user to re-authenticate every time an access token expires would make an application unusable, so the OAuth flow also issues a refresh token, which is stored more securely and used behind the scenes to silently mint a fresh access token when the old one expires. The refresh token itself is long-lived, sometimes indefinitely, until it's revoked. Because refresh tokens grant ongoing access, they're one of the highest-value secrets in a system and require careful handling: encryption at rest, rotation on use (issuing a new refresh token each time the old one is redeemed, invalidating the previous one), and revocation paths when a user disconnects an integration or an account is compromised. A leaked refresh token is effectively a leaked long-term login. Refresh tokens are the mechanism that lets a background job — a scheduled sync, an automated agent — keep acting on a user's behalf hours or days after the user last opened the app, without storing their password.