How do refresh tokens work alongside short-lived access tokens, and why is this pattern used?

Access tokens are intentionally short-lived (minutes to a couple hours) to limit the damage if one is stolen, while a longer-lived refresh token (stored more securely, often HttpOnly cookie) can be exchanged for a new access token without requiring the user to re-authenticate with credentials again, balancing security (short exposure window) with usability (infrequent re-logins).

// Client uses access token normally until it expires
// Then exchanges the refresh token for a new pair:
POST /auth/refresh
{ "refreshToken": "long-lived-opaque-token" }

// Response:
{ "accessToken": "new-short-lived-jwt", "refreshToken": "new-refresh-token" }