Refresh Token
A long-lived credential a client stores privately and exchanges at the authorization server for new access tokens, so the user isn't asked to re-approve access every few minutes.
Where access tokens are used constantly and stay exposed, refresh tokens are used rarely and stay guarded — kept server-side or in secure device storage, never attached to an API call. OAuth 2.1 pushes this further, requiring refresh tokens to be sender-constrained or rotated on use so a leaked one can’t be replayed indefinitely.