Thanks for this amazing piece Fawas Kareem , indeed with refresh tokens, access tokens can have shorter lifespans, reducing the window for malicious activity.