Instead of returning two token after login, can I put refresh token inside access token?
When access token becomes expired, user need to pass expired token to get new acc