What is the difference between an access token and a refresh token?
Assesses fundamental understanding of Authentication & Authorization conventions, runtime behavior, and memory/performance considerations.
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
An access token is short-lived, typically minutes, and is presented to APIs to authorize requests. If it leaks, the exposure window is small. It is usually a JWT so resource servers can verify it without a central lookup.
A refresh token is long-lived and is used only against the authorization server to obtain new access tokens, so the user does not re-authenticate constantly. It is an opaque credential, stored securely server-side or in a protected client store, and should never be sent to resource servers.
POST /token
grant_type=refresh_token&refresh_token=...&client_id=app
Best practices: keep access tokens in memory where possible, rotate refresh tokens on each use, bind them to the client, and revoke the whole chain if a used refresh token is replayed, which signals theft. Store browser tokens in HttpOnly, Secure cookies when feasible rather than localStorage, and always use TLS.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.