The point of refresh tokens is not to be more secure than access tokens, but to make some implementations more convenient.
- It's easier to change the format of short-lived access tokens, since you know there are no valid tokens hanging around after the expiry time. In contrast you may want refresh tokens to be valid for months or years.
- Every endpoint in your system must read access tokens, but only your authorization endpoint needs to read refresh tokens.
- In some cases it is acceptable to do checks only when verifying refresh tokens, e.g. checking for revocation only when refreshing the tokens, while access tokens are trusted implicitly while valid.
For a simple implementation you can just issue long-lived access tokens, use of refresh tokens is optional.
- It's easier to change the format of short-lived access tokens, since you know there are no valid tokens hanging around after the expiry time. In contrast you may want refresh tokens to be valid for months or years.
- Every endpoint in your system must read access tokens, but only your authorization endpoint needs to read refresh tokens.
- In some cases it is acceptable to do checks only when verifying refresh tokens, e.g. checking for revocation only when refreshing the tokens, while access tokens are trusted implicitly while valid.
For a simple implementation you can just issue long-lived access tokens, use of refresh tokens is optional.