The original title is "Access vs Refresh Tokens: I Was Missing Two Ideas"

Short summary

A developer recounts their journey from misunderstanding token-based auth to grasping why access and refresh tokens exist as separate concepts. The key insights were that tokens can be stateful for revocation purposes and that scopes allow restricting tokens to specific tasks. The post is a candid, narrative-driven explanation of auth fundamentals that many developers get wrong.

• •Author initially shipped a single long-lived JWT with no revocation, misunderstanding why two tokens exist
• •Key realizations: tokens can be stored for revocation, and scopes let you restrict a token to specific tasks
• •Narrative-style explainer covering common misconceptions about stateless auth and token design

Generated with AI, which can make mistakes.