API Design · Middle · Question 33 of 75

Why should access tokens be short-lived?

1Long tokens can't be validated
✓Correct answer: A leaked token can be used only briefly; refresh tokens (with rotation) get new ones without asking the user to log in again
3Short tokens are smaller

Explanation

Self-contained JWTs are hard to revoke, so short lifetimes limit the damage.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.