...
Both the id token
and the access token
usually are only valid for a number of seconds as indicated in the exp
claim. In order to prolong the access token, there is the concept of a refresh token
that can be user used to request a new access token
without the users interaction. This allows an application to act on behalf of the user even beyond the users interaction. This is done by issuing a refresh token
to the application. The application then can exchange that refresh token
for a new access token
.
...