Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Access and refresh token questions reveal whether token design is treated as session management, not just a login response.
An access token is used to call APIs and is usually short-lived. A refresh token is used to obtain a new access token without making the user log in again. Keeping access tokens short-lived limits damage if one leaks, while refresh tokens provide continuity. Refresh tokens need stronger protection because they can extend a session.