Comparison questionMedium~7 minAuth Foundations / 4 of 9

Interview question

Why do systems often use both access tokens and refresh tokens?

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

An access token is used to call APIs and is usually short-lived. A refresh token is used to obtain a new access token without making the user log in again. Keeping access tokens short-lived limits damage if one leaks, while refresh tokens provide continuity. Refresh tokens need stronger protection because they can extend a session.

Full answer below

Practice focus

Token lifetime, session continuity, refresh rotation, revocation, replay detection, and browser/mobile storage trade-offs.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Access and refresh token questions reveal whether token design is treated as session management, not just a login response.
An access token is used to call APIs and is usually short-lived. A refresh token is used to obtain a new access token without making the user log in again. Keeping access tokens short-lived limits damage if one leaks, while refresh tokens provide continuity. Refresh tokens need stronger protection because they can extend a session.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would store and handle refresh tokens as sensitive session credentials. A common design rotates the refresh token on each use and stores a hashed token or token id server-side so stolen old tokens can be detected and revoked. Logout, password change, account disable, and suspicious activity should revoke the relevant refresh tokens or sessions. The API should not treat access-token expiration as an error users cannot recover from.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I would choose storage based on the client. Browser apps often use secure, HttpOnly, SameSite cookies for refresh tokens to reduce token theft through JavaScript, while mobile apps use platform secure storage. I would monitor refresh failures, replay attempts, token family revocation, device/session lists, and unusual refresh patterns. The design should let users and support revoke a device without invalidating every user in the system.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Using long-lived access tokens because refresh is inconvenient.
Storing refresh tokens in localStorage without considering theft risk.
No server-side revocation or rotation.
Treating logout as only deleting a client value.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Cannot explain different token lifetimes.
No replay detection for refresh tokens.
No revocation story after password change or account disable.
No storage trade-off for browser clients.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why rotate refresh tokens?
What happens after logout?
Where would a browser app store refresh tokens?

Continue the section

Next in Auth Foundations: Session Revocation

Step 5 of 9

Handle logout, device revocation, and active sessions

Opening drill

Comparison questionMedium~7 minAuth Foundations / 4 of 9

Interview question

Why do systems often use both access tokens and refresh tokens?

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Token lifetime, session continuity, refresh rotation, revocation, replay detection, and browser/mobile storage trade-offs.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Access and refresh token questions reveal whether token design is treated as session management, not just a login response.
An access token is used to call APIs and is usually short-lived. A refresh token is used to obtain a new access token without making the user log in again. Keeping access tokens short-lived limits damage if one leaks, while refresh tokens provide continuity. Refresh tokens need stronger protection because they can extend a session.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would store and handle refresh tokens as sensitive session credentials. A common design rotates the refresh token on each use and stores a hashed token or token id server-side so stolen old tokens can be detected and revoked. Logout, password change, account disable, and suspicious activity should revoke the relevant refresh tokens or sessions. The API should not treat access-token expiration as an error users cannot recover from.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I would choose storage based on the client. Browser apps often use secure, HttpOnly, SameSite cookies for refresh tokens to reduce token theft through JavaScript, while mobile apps use platform secure storage. I would monitor refresh failures, replay attempts, token family revocation, device/session lists, and unusual refresh patterns. The design should let users and support revoke a device without invalidating every user in the system.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Using long-lived access tokens because refresh is inconvenient.
Storing refresh tokens in localStorage without considering theft risk.
No server-side revocation or rotation.
Treating logout as only deleting a client value.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Cannot explain different token lifetimes.
No replay detection for refresh tokens.
No revocation story after password change or account disable.
No storage trade-off for browser clients.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why do systems often use both access tokens and refresh tokens?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section

Why do systems often use both access tokens and refresh tokens?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section