Implementing OAuth Refresh Tokens that never expire
问题 In the context of OAuth 2, how does one deal with refresh_token expiry, or lack thereof? I'm using JSON Web Tokens (JWTs) as access_token s with a short lifetime (expires after 20 minutes). From what I understand, this means I shouldn't have to store the access_token , only validate it (and consume the trusted information inside, like scopes). However, I'm wondering how one implements refresh_token s. In my research, I've seen that Google and others have refresh_token s which are good forever