Thanks for this amazing piece Fawas Kareem, indeed with refresh tokens, access tokens can have shorter lifespans, reducing the window for malicious activity.